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Many of the articles published in COMPUTIST detail the removal of copy protection schemes 
from commeroiai disks or contain mformalion on copy protection and backup metliods in genera!. 
We a] so print hit copy parameters, tips for adventure games, advanced piaying techniques (APT's) 
for arcade game fanatics and any other intormation which may be of use to the serious Apple user. 
COMPUTIST also contains a special CORE section which focuses on information not directly 
related to copy protection. Topics may include, but are not limited to: tutorials, hardware/software 
product reviews and application and utility programs. 



What Is A Softkey Aayway? Softkcy is a lerm 
which wc coined to describe a procedure diat removes, 
or at least circiimvenrs, any copy protection on a 
particular disk. Once a softkcy procedure has been 
perfonned, ihe resulting disk can usually be copied by 
the use of Apple's COPY A program <on the tX>S .1.1 
System Miister Disk). 

Commands And Controls; lii aiiy articlt appearing 
in COMPUTIST. commands which a reader is required 
to perform arc set apart from normal text liy hting 
indented and bold. An example ia: 
PR#6 

Follow this with the RETURN key. The RETURN key 
must be pres.scit a! I he end oi eveiy such cammajid unless 
otherwise specified. 

Control characters are indicated by being bOTlcd, An 
example is: 

To complete this command, you must first type the 
number 6 and then place one finger on the CTRL key 

and one fiDgei tin iJie P key. 

Kequircincnts: Most of the programs and softkeys 
which appear in COMPUTIST require one of the Apple 
][ series of computers and at least on disk drive with DOS 
3.3. Occasionally, some projirams and procedures have 
special requirements. The prerequisites for deprotectimi 
Eecluuques ur programs will always be listed at die 
beginning of the article under the "Requireiiienlic" 
heiiding. 

Software Recommendations: Tl le To 1 1 l >w ) ng pro- 
grams (ur similar ones) are snongly recommended for 
readers who wish to obtain the most benefit from our 
articles: 

1) Applesoft Program Editor .such a.<: Globil Progrmn 
Line Editor (GPLE). 

2) Sector Editor such a.<; IJiskhdit, ZAP from Bag of 
Tricks or Tricky Dick from The CIA. 

3) Disk Search Utility such as the Inspector, The 
Tracer from The CIA or The CORE Disk Searcher. 

4) Assembler such as the S-C Assembler or Merlin/Big 
Mac. 

5) Bit Copy Program such as Copy ]{ Plus, Lockaniih 
or The Essential Data Duplicator 

S) Text I'lditor capable of producing normal sequential 
text files such as Appiewritcr ][, Magic Window ][ 
or Screenwriter ]l. 
You will also find COPYA, FID and MUFFIN from 

die DOS 3,3 System Master Disk useful. 

Super lOB; This program has most recently appeared 
in COMPUnST No. 22. Several sofikcy procedures will 
make use of a Super lOB controller, a sniall progriinj 
diat must be keyed into the middle of Super lOB. The 
controller changes Super lOB so that it can copy differKril 
disks. To get the latest version of this program, you may 
order COMPUTIST No. 22 as a back i.s.sue or order 
Program Library Disk No. 22, 

RESET Into The Monitor: Some softkey pro- 
cedures require that the user be able to enter the Apple's 
system monitor during die execution ola copy protecttai 
program. Check the following list to see what hardware 
you will need to obtain tt^iK ahihty. 

Apple ][ Plus - Apple //e - Apple compatibles: 1 ) Place 
an Integer BASIC ROM card in one of the Apple slots. 
2) Use a non-maskable interrupt (NMI) card such ai 
Replay or Wildcard. 

Apple ][ Plus - Apple compatibles; I) Install an F8 ROM 
with a modified SKSKT vector on the eomputer's 



modicrboard a<i detailed in *e "Modified ROM's"' article 
of COMPUTIST No. 6 or the "Dual ROM's" anlele 
in COMPUTIST No. 19. 

Apple //e - Apple //c: Install a modified CD ROM on 
the computer's motherboard. Clay Han-ell's company 
(Cutting Edge Em.; Box 43234 Ren Cen Station-HC; 
Detroit, MI 48243) &elk a liai-dware device that will 
give you this ability. Making this modification to an 
Apple /k will void its warranty but tJie iiitreaSBd iibility 
(o remove copy proiection may justify it. 
Recommended Litei-ature: The Apple ir Reference 
Manual and DOS 3.3 manual are musts for any serious 
Apple user. Other tielpful books include: Beneath Apple 
DOS, Don Worth and Peter Leichner, Quality Software, 
SI 9. 95; Afmcmhty Language For The Applesoft 
Programmer, Roy Meyers and C.W. Finley, Addison 
Wesley, .'816.95: and Whm's Where In The Apple, 
William Lubert. Micro Ink., 124.95. 
Keying In ApiriesiOft Pmgranis: BASIC programs 

are printed in COMPUTKT in ;i fonoEit thsu is designed 
to nninitniEC errors fbr readers who key in these programs. 
To understand this format, you mu-iit first understand the 
formatted LIST feature of Applesoft. 

An illustration- If you .■strike Iht^Ne keys: 

1« HOME:REMCLEAR SCREEN 
a program will be stored in the computer's memory. 
Strangely, this program will not have a LIST that is 
exactly as you typed it. Instead, the LIST will look like 
this: 

1» HOME : REM CLEAR SCREEN 

Programs don't usually LIST the same as they were 
keyed in because Applesoft inserts spaces mto a program 
listing lieforK and after every command word or 
madiematical operator. These spaces usually don't pose 
a pniblem BKcept in line numbers which contain REM 
or DATA command worxls. The space inserted after these 
command worrls ran be misleading. For example, if you 
want a program to have a list like dii.s: 

lit DATA 67,43,54,52 
you would have tfi oioil the space diiBctiy after ttie DATA 
command word. If you were to key in the space directly 
after tlie DATA ctimnuuid word, the LIST of the program 
would look like this; 

1« DATA 67,45,54,52 
This LIST is different from die LIST you wanted. The 
number of spaces you key after DATA and REM 
command words is very important. 

All of this brings us to the COMPUTIST USTing 
format. In a BASIC LlSI'ing, dier^ are two rypes of 
spaces; spaces that don't matter whether they are keyed 
or not and spaces that must be keyed. .Spaces that must 
be keyed in arc primed as dela characters (*). All other 
spaces in a COMPUTIST BASIC listing are put there 
for easier reading and it doesn't matter whether you type 
them or not. 

There is one exception: If you want your checksums 
(See "Coniputing ClMx:ksums" section) to match up, you 
mus! not key in any spaces after a DATA command word 
unless tliey are marked by delta chamcters. 
Keying In Hexdumps: Machine language programs 
Eire printed in COMPUTIST as both source code and 
hexdumps, Only one of these formats need lie keyed in 
lo get a machine language program. Hcxdumps are the 
shortest and easiest format to t}pe in. 

To key in hexdumps, you must first enter the monitor; 

CALL -ISl 

Now key in the hexdump exactly as it appears in the 
nmgazine igiiorinjr; the jbiir-digit checksum at the end 
of eatrh line (a "$" and four digits). If you hear a beep, 



you will know that you have lyptiti something 
incorrectly and must retype that line. 

When finished, return to BASIC with a: 

JitnrJu 

Remember to BS AVE the progriuu with the correct 
fdenamc, address and length parameters as given in 
the article 

Keying In Source Code The •umas code 

portion of a maehinc language program is provided 
only to better eApiaui the program's operation. If you 
wish to key it in, you will need an assembler. The 
S-C AssembliiT i^ ustid ro generate all source code 
printed m COMPUTIST. Without this a.ssembler, 
you will have to translate pieces of the source code 
into something your assembler wdl understand. A 
table of S-C Assenrtiler tlirectives just for this purpose 
was printed in COMPUTIST No. 17. To ir-an slate 
source code, you will need to understand Ibc 
directives of your assembler and convert the 
directives used in the source code listing to similar 
directives used by your assembler. 

Computing Checksums Checksums are four 
digit hexadecimal numbers which verify whether or 
not you keyed a program exactly a.s it was printed 
m COMPUTIST. There art two types of checksums; 
one created by the CHKCKBIN program (for 
machine language programs) and the other created 
by the CHKCKSOFT program (for BASIC 
programs). Bodi programs appeared in COMPUTIST 
No, I and The Best of Hardcore Computing. An 
update 10 CHECKSOFT appeared in COMPUTIST 
No. IS. little checJcsums these programs create on 
your computer match the checksums accompanying 
the program in the magazine, then you keyed in the 
program correctly. If not, the piiograin is incorrect 
at the line where (he first checksum differs. 

1) To compute CHECKSOFT checksums: 

LOAD CileiuiEne 
BRUNCHECKSOrr 

Get the checksums with 

& -^ 
And correct the program where the checksums difler. 

2) To compute CHECKBIN checksums: 
CALL -ISl 

BLOAD rifenaine 

Install CHECKBIN at an out of the way place 

BRUN CH£CKBIN,A$«»»e 

ttet the checksums by typing the starting address, 
a period and ending address of tlie fde followed by 



a BY 

And correct the lines at which the checksums difler. 



Coping with 
COMi>UTIST 

Welcome to COMPUTIST, a publication 
devoted to tlie seriou.s user of Apple ]| and 
Apple ][ compatible compukTs. Our 
magazine eontainii information you are not 
liltely to find in any of the other major 
journals dedicated to tlie Apple market. 

Our editorial policy is tiiat we do NOT 
condone software piracy, t>ut we do believe 
that tionest users are enlillcd to backup 
commercial dislis they have purchased. In 
addition to the security of a backup di^k, 
the removal of copy protection gives the user 
the option of modifying application 
programs to meet his or her needs. 

New readers are advised to read this page 
carefully to avoid frustration when 
attempting to follow a softkey or when 
enterii^ the programs printed in this issue. 
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Check your mailing label to see il" you need to renew your subseripLian, And if you think you might forget when (liat ralul lime arrives, renew 
right now. Just use the order blank below. 



if you're moving, 

Lcl us know right away or at leusl 30 days in atlvance so thai yoti 
won't miss a single issue. Just write your new address here, and 
paste your present address label in the order form below and send 
it to US- Issues missed due to non-receipt of this Change-of- Address 
may be atjuircd at the regular back-issue rates. My new addrtss is; 



Name _ 
Address. 

City 

Country 



.State. 



Phone 



.Zip. 




We are NOT 





but ^ve'ire not fools, either. 

We're serious programmers and software users who just want to have backup copies of any software we own. 
COMPUTIST magazine shows us HOW TO MAKE BACKUPS OF COMMERCIAL SOFTWARE regardless of the maker's 
attempt to stop us from having legal copies. Don't let them stop you from protecting your own rights. 

Remove copy-protection from your valuable library of expensive software. The publisher of COMPUTIST has been showing subscribers 
how to Linlock and modify commeccial software for the past 4 years. Don't be one of the users abused by user-FIENDLY locked-up software. 
Subscribe. 



6 issue SUBSCtSPTiON RATE-S; 
US.. $20 (irsi class: S2ii 
Conada, Mexico: S3^ 
Other Foreign; $60 

SAfvlPLE COPY: 
U.S;: S4.76 Foreign: S5.70 
US furids drawn on U.S, t>ank. 
In Wasfiingtnn adcj 7,8% lox. 
Send ctieck.ot moriev order to 

COMPUTIST 

PO Box 110846-T 

Tacoma, WA 98411 



n N6W suUertoer 

Nome 


n Renew my subscription 








ID* 


Aiickess 


Coiintrv 




Slate 
Phone 


Zip 


_ &p. _ 





Signature 



_CP2S 



REWARD 



up to 



$100.00 



Flight 
Simulator II 



Sub Logic 



ir your sof^key to this program is 
published in COMPUTIST. 



REWARD 



up to 



$90.00 



Guteiiburg 
Jr. & Sr. 

Micromanon LTD 



Vl your sottkey to this program is 
published in COMPUTIST. 



REWARD 



up to 



$80.00 



The Handlers 



silicon Valley Sysiems 



If your softkey to this program is 
published in COMPUTIST. 



Unlock the Sof tmare Secrets 

The Senior PROM //c^ //e: A unique device 
which combines the features of a copy card, sector 
editor, memory detective, nibble copier, absolute 
reset, and mucK more into a single affordable tool. 
Provides Assembly Language utilities such is an 
Assembler, Step and Trace, and more. ROM resident 
operating system vith disk copy„ format, edit, and 
protected disk utilities, all vithout booting DOS first! 

All the Senior PROM's features are in RDM, in- 
stantly available vhen needed. Undetectable by any 
software or hardware, does not use a peripheral slot. 
Extensive documentation &. guide to copy -protection. 
Nothing else like it available for the //c! 

Economically priced at $79.95 for prepaid orders 
with a check or money order. Credit Card orders 
available for $88.95. Please specify //c . or /Ae 
Standard or Enhanced ROMs. 

Cutting '^dge 
'^-nterprises 

Box 43C23!4 Ren C«n Station 

Detroit, Ml 48243 

313-349-2954 Modem. 

For 




^ T-tlT. 



orders call 

317-743-4041, 10-5 E.S.T. 

not intended for illegal use. 



THE TOST POWERFUL BflCK-UP UTILITY 
YOU'ViE EliER SEEN... 




^- 



$59.95 addSS ship. 

« Back-ups 1/2, l/4, 3/6 tracks. 
" Automatic back-up optians. 

"' [Ma parms needed for most of the back-upsv 
" Excellent DOS copy on flip side, 

H5k for our other products RAM-LOCK (for L-Smith) 
ftnd also SHOUGl (Japanese chess-type game.) 

ART GALLERY 
Yoshinoya Bldg,'i3R Sasu-machi,Chofu-shi ' 

Tokyo 1S2, Japan 
Ssnd money or chsck. UISA/CIASTER CARD accepted. 




by bobby 

PHD, pliD, Phd, PhD, 
BUT, BLT, MSG, McDLT 



(I'v! \Kiji ihal some ptsplt luspttt Ihal 
:h(re's i' rui or ihii su:h n iniftti dcts noi 
yci (xisi.-.VAPORWbAR...)" 

Ifyoulike m y id ti , then PLEASE »rd£r th« 
CLASSIC Hi rd to re Com pus i si DiskBusltJS T- 
shin (lim ply kiowii ,is CLASSIC T-shiri) 



1) Fill out ihc diijer forui belt wusinglht Pti 
and [hen Irscii tht ordtt fern wiihi{)|)rtpTiiic 

$$$[ir lu-cpliblc sublimiej in Id the tn vtiopr. 
sid ihtii [mi-iii ihc Jdiirts! quo iht ctvclnpc,- 
std lh(D 2 111 ch the stamp i n J ihal's it. 
Etijfiy! 



Requirements 

IV m I $$$ 

punige stim p 

EnvelopE 

Pin or iioir p itible wotti pioic jsoi 

scisson (opiioml) 

No w 1 hi 1 HARDCORE hi s c hi n gtJ its n a ra e 
to pljii old 'tittm putisi', Vvt bit it isitgtied the 
tegrtttibly red uo dint retponsibility o fchiiigiiig 
all ih( DiskhiisiM! T-shins. Insiud , usiii g m y 
own im iginary inttialiV! , I'vt; I'Oni e up wiilu 
I c ] s n s bl c f] c .t i rfl lie o f i n o r i gi n 9 1 i d e i . . . 

"Why not," I asked myself, *'call all the 
old Dl.itkhusiterK T'Shlrt somethiniE! catchy 
like; Hardcore Classic?" 

"Wow!" I answered myself, "Then we 
could sell people the NEW uumputisl T-shirts 
this summer!" 



I want the classic: so rush me dotal) Classic DISKBUSTERS T-SHIRTS in the sizes indicated 

tielow, [ have t;in:!u5t!d S9.95 (plus tas and shipping) for each sliirt. 

ADULT MENS: Small Medium I..arge Xtra large 



Ni nt i . 



_ID#_ 



Adilress. 
Oty 



Countiy 



_Siite. 



.Zip. 



Photie 



Exp . 



Signature. 



_CP28 



Stnd theek 01 money oider lo: Bullshin; PO Box 110816-T; Thoiu, WA 984n. 

Washiiigtdfl ordeis idd 7.8% sales iix. Foreign ordtfs sdd 20% shippingmj handling. 
US fun d s d r a wn on US bi n k. 
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This tnonth'i covvr: 

Graphk.i frmn Uhra^ofi 's ' Seipeiu 's Sar, ' ' 

Address all attveiisihg [raiulrlestoOOMPUTIST, Adverfielng 

Oepanmsnt, PO Bm 110eie, Tacoira, WA dS41t. Mail 
manuscripts or raquegts for Writer's Guides to COMPUTI ST, PO 
fliw 1 l08i6-«, Tacoma, WA ssai i. 

K^lurn postage must accon^pany all manuscrlple, ijrawjng&, 
photos^ ditikii, Qi tap^E^ 1^ tbf^y ara Eo b? ratufne^, Urisalicltad 
martusorlptswflE bo returnad nnly II EidaquatG return postage is 
InoludBd. 

Entire contents copyrignt 19Bt> Dy SoftKey PuOlishmg. All 
nghis reserved, Cop/ing done lor older than peisdoal or internal 

relarenuB (wilhoul fjxpjsfss writtBn pDrmisEiDn frnm Iho publhtiDrJ 
Ir prnhltilted 

TTie editorlai slafi assurnes no (latrllity or rssponsiBility tor me 
products aduertiESd in the magazine. An/ opinions exprassed 
by the authors are not necessarll]/ those ol COMPUTIST 
mege^rne or SoftKey Publishing 

Apple usually refers to the Apple || or ]| Plus Cornputar, and 
is a trademark of Apple Computers, Inc. 

SUBSCniPTIONS: Rates [tor 6 Issues): US, SSO, U.S, 131 
Claas $24, Canada & t/laxico $34, Foreign $ec. Direct Inquiries 
to: COMPUTISt. Sutjsctlptlon Deoortmsnt, PO BOX 
110046-7, Tacoma, WA 9&411. Please inGJuds address^ lat>al 
with corrfispondance 

DOMESTIC DEALER RATES; Call (aOfl) 474-57S0 tor more 

Iriformalioii. 

Change Of Address: Pleasa allow 4 waaKs for cl'iang^ of 
address to taKe elfect. On postal form 357e supply your new 
address and your most receitt atlJress latiel. Isiiues oiiss^ [Juh 
tu uon-raceipt oi cliajige ol address may be acquired at the 
regiilat hack Issue tuts 
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softkeys 

10 Ultima IV 

by Mike Ruelmun 

12 Robot Odyssey 

by Steve Luzietii 

13 Rendezvous 

hy The Nipper 

14 Word Attack A Classmate 

by Ditve Skmion 

22 Three from Rlindscape 

by Jeff Riven 

23 Alphabetic Keyboarding 

by Marc lirette 

24 Hacker 

by Ji'ffRhetl _^ 

25 Disk Director 

by A. L Head Jr. 

26 L€>de Runner (revisited) 

hy Steve Marvin 

28 MIDI/4 

by Ray Durrah 

feature: 

20 Capturing the Hidden Archon Editor 

By now you've probably heard about the shape editor that is included (but not documented) 
with your Archon disk. Now you can capture this editor and put it on a disk of its own. 
Many other secrets of this editor are exposed! by Sieve and Rod Smith 

core: 

16 Fingerprint Plus: A review 

This article exatnines the age old question: Can a printer card double ax a modified ROM? 
Apparently that k what Thirdware Computer Products believes. Because uf tlieir insight, 
this incredible piece of hardware is a real bargain, by Michael Stafford 

1 8 Beneath Beyond Castle Wolf enstein (part 2) 

Learn the rest of the Beyond Castle Wolfenstein story with this article, by Lars Grant-West 
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Input 

Most Wanted List 

Readers' Softkey & Copy Exchange 




Please address tetters to: 

COMPUTIST 

Editorial Department 

PO Box 110846-K 

Tacoma, WA 98411 



Include your name, address and 
phone number. 

Correspondence appearing in the 
INPUT section may be edited for 
clarity and space requirements. In 
addition, because of the great 
number of letters that we receive and 
the small size of our staff, a response 
to each letter is not guaranteed. 

Our technical staff is available for 
phone calls between 1:30 pm and 
4:30 pm (PST) on Tuesdays and 
Thursdays only. 



Zapped 



I have a question. A friend of mine had 
Anworx Strip Poker in the disk drive and was 
trying to figure out how to deprotect it, when 
his computer line was struck by lightning. Ttiis 
caused his language card to freak out and by 
some weird instance, it deprotected Strip Poker! 
How!?! 

Baron Von Zonker 
Mr. Zonker: As I see it, ihere are three poxsihle 
reasons for this event: 

\} The Ugluning caused the conipuler to execute 
a routine which was responsible for 
deprotecting the game. 

2} The psychic energy caused by ywir friend's 
intense desire to deproiect the game was 
amplified by the lightning thus producing a 
deprotected copy. 

3) Perhaps Cod is on our side of the copy 
protection rat race and this was his way of 
getting back ai the system. 



The EDD Syndrome 

I would like to tell you how much I enjoy 
your magazine. I think it has helped me to 
understand the Apple JL computer operadons 
more than any other single book or magazine. 



It does take a lot of study to understand 
programming and protection techniques 
however, and 1 am stiil learning. I am writing 
to tell you of some of my experienees using 
your magazine articles to softkey one of my 
programs. 

The program diat I started on was EDD m. 
I u.sed the article on EDD I in COMPXJTIST 
No. 8, pg 24 and the material in COMPUTIST 
No. Ifl, pg 7 to get started. I booted up my copy 
of EDD HI and went into the monitor u.sing the 
modified EPROM technique described in the 
"Double Your ROM Space" article by Ray 
Danah in COMPUTIST No. 19, pg 9. (NOTE; 
I used a 2754 EPROM technique which 1 am 
going to write up for a possible future article.) 

I followed the steps described for EDD I with 
the changes suggested for EDD IH. My copy 
is dated March 1 , 1985 so 1 changed the address 
at $4026 to 53, After following these steps I 
saved die program and tried it. No luck! It 
would not boot, so I decided to see what I could 
do. 

I rebooted EDD HI ajid reset into ihc monitor 
when the program stops at the title screen. I 
looked at the memory area at $6000 and there 
was already code there. Moving the $800 page 
up to this address had overwritten something. 
This code extended from $6006 to $62FF so 
I used a 6300<0800.08FFM command to move 
page 8 to the open $6300 area. I then booted 
a slave disk as described in the basic 
COMPUTIST article, moved die $800 page 
back, and continued on, I should mention at this 
point that I msened a S6fl at .$1EE8 and $3EE9 
since tise deleted operation occupied both 
positions. I don't know if this makes a 
difference here (I am still studying assembly 
language) but it keeps all of the other code at 
the same address. I tried saving this and booting 
it, but no luck. I kept trying things and I could 
get my copies to start, but they would stop 
unexpectedly, Finally, I was desperate. I had 
a version that would work if I called the 
program start address. I mought maytie the 
DOS pointers were not being restored properly 
so I decided to do something I had never heard 
done before! I did a massive BSAVE from 
$0000 to $6300! This worked (surprised me) 
after a fashion hut I was not satisfied. It loaded 
garbage on the screen and required a "CALL 
2045" to start. I continued to examine the 
program code to find a better way to do it. I 
rebooted the master copy of EDD ni and took 
a look at the new JSR at $07FD and there it 
wa.s! It had a JSR to the code at $6000 already 
there, which was getting overwritiEn by the JSR 
to $4000. 1 looked ahead of this and it was clear 
so I added the JSR $4flB0 at $07FA, QSAVED 
it all to $6300 and it worked! I had all of HDD 
in except the hi-res introductoiy picmre in 



COPYA format, I modified the Hello program 
to BRUN EDD m and the final copy hoots in 
about 25 seconds. The complete procedure is 
given t>elow. 

Summary 

1) RUN EDD m. 

2) Reset into the monitor. 

3) Change $3EE8 to $60. 
3£E8:6« 

4) Change $3EE9 to $60. (Replaces 2 byte 
command) 

mE9M 

5) Move memory 

6) Boot initialized slave disk 
C6e«G(for slot 6) 

7) Move memoty back 
«8M<63W.63FFM 

8) Insert die COIVIPUTIST code at $4000 

4000 :A9 00 8D fZ 03 A9 C5 80 

4008 :F3 03 20 6F FB A9 F0 85 

4010:36 A9 fU 85 37 A9 IB 85 

4018:33 A9 FD 85 39 A9 60 85 

mSM A9 m 85 0B 4C 5E 09 

9) Change start address 
4fl2ti;S3 0P 

10) Insert the new start JSR 
»7FA:4C m 4» 

11) Save EDD m (From $7FA TO $62FF) 
BSAVE EDD 111, A$»7FA, L$5B»6 

12) That's it. Modify HELLO to di.<;play 
"BRUNNING EDD HI" and tlien BRUN it 
automatically if you like. It is now completely 
broken. 

M. A, Todd 
Ft. Walton Beach, FL 



What about my Hard Disk? 

As an avid reader of your fine publication, 
but somewhat of a novice at the computer; I 
have been successful in creating a COPYAahle 
copy of Sensible Speller DOS 3,3 that runs just 
as Lamont Cranston said it should. However, 
I Just purchased a 10 megabyte Sidcr hard disk 
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and would very much like to copy Sensible 
Speller rum this drive for obvious reasons. My 
ijueslioii is this, "Can you, or any of your 
readers assist me to accotnpllsh this?' ' 

1 can transfer Sensible Speller to the hard disk 
with no problem, but when 1 boot it will dump 
me into the monitor. 

Samuel Tenney 
Ontario, CA 
Mr. Tenney: A Sofikey can generally be divided 
into two broad catagories: 

IJ ,4 Broken file: The result is file (s} that can 
be BSA VEd, BLOADed. SA VEd and LOADed. 

2) A COPYAable disk: 'Ihe resulting disk is 
COPYAable and tlierefore requires most every 
track and sector of the disk, especially the boot 
tracks. 

A program that goes through the first type 
of sofikey can usually be put on to any hard disk 
without much difficulty. Usually these programs 
have no disk access during the program. 

Unjbmmmelyjbr hard disk owner.i, the more 
sophisticated programs usually fit into the 
second category. This is the case with Sensible 
Speller, These programs either have disk access 
during their execution or are loaded directly 
into memory rather than having a file structure. 

Due to the nature of hard disks, it is VERY 
difficult (sometimes impossible) to move these 
COPYAable disks to hard di.iks. To accomplish 
such a thing, you would have to follow the boot 
sequence of the COPYAable disk (a lot of 
knowledge about machine language and DOS 
is required) to figure out what sectors are 
loaded where and then convert this information 
to something your hard disk can emulate by 
writing a new boot routine. 



Checksum Confusion 



Gentlemen: 

Too many times in your BASIC listings of 
programs, the author will "decorate" the 
beginning of the listing wiih slashes and 
backslashes. What use is it to include 
checksums for the programs that include 
backslashes? I have an Apple ][ which, to my 
knowledge, will not print blackslashes. Please 
refrain from printing backslashes m program 
listings or tell me how 1 can enter them from 
an Apple ][. Until I can print a backslash, the 
checksums are mseiess and I must proofread my 
entire listing. 

P.S. Core's "Wheel of Money" on page 26 

Of COMPUTIST No. 23 is a listing that uses 

the backslash m lines 10, 20, 80, and 90. 

Michael L. Knickman 

Hampstead, MD 



Mr. Knickman: A little known fact about our 
checksum program (Checksofi) is thai it ignores 
everything on a line following a REM command. 
We at COMPUTIST certainly don 't expect our 
readers to key in our fancy (yet .sometime.'^ 
bothersome) REMs. 

[f there is a line of a program containing a 
REM that you can 't type (or don 'I want (o), all 
you have to do is type the line number followed 
by the command word REM and nothing else. 
The checksums will be the same no matter what 
(if anything) you put after a REM. 



If it Weren't for Bad Luck ... 

I have been reading your magazine for about 
a year-and-a-half now and enjoying it 
thoroughly! 1 have deprotected many programs 
with your lOB. There are, however some 
problems I have run into along the way, and 
would greatly appreciate you or my fellow 
readers' help in solving them. 

1) The latest update of lOB (1.5) does not 
function. It comes up on the screen and says 
it's reading and writing, but neither of my 
drives ever gets activated!!! 

2) The softkey update for EDD Ul did not work 
for my version, dated May 25, 1984. 

3) The softkey for F-15 did not work on my 
version. The tracks my copy used for protection 
were 09 and 0A. Any help on that one? 

4) Sticky bear! I've tried every method seen in 
COMPUTIST but still no backup. I have ABC 
and Numbers. 

And now, if 1 might offer a little help. 
Regarding the sofikey for Archon in 
COMPUTIST No. 21. The modifications to 
track 2, sector 0, were incorrect. The last two 
lines in the machine code should have read: 

SF0: 48 A9 EA 8D 00 A0 60 40 
$F8: Al 8D 02 AB 68 4C D4 BC 

I^st but not least, if you must print the latest 
copy parameters, (available by the way, to any 
registered owner), you could print those for 
Locksmith 5.0 and Copy J[ Pius, not just 
EDD!!! My secondary objeaion to this is the 
use of four pages of available space for 
sofikey s, APT's and other great infoi-raation! ! ! 

Unless this letter gets printed, my chances 
for assistance are narrowed. Please, I've written 
before. I'm desperatctll 

Michael Ferreira 
Santa Rosa, CA 

Mr, Ferreira: You are wrong about Super lOB 
vl.5. It works perfectly as we printed it. Either 



you typed .something wrong or forgot to key in 
the new hexdump. 

Perhaps the softkey for EDD III in the input 
column of this issue will wot^ for your version. 

It has come to our attention tlua there are 
several verisons of F-15 Strike Eagle. Therefore 
I can only .luggest that you .iiay tuned to 
COMPUTIST fur fitrther episodes in the F-15 
saga. A .wnilar comment works for Sticky Bear 
stuff. 

Finally, Central Point Sofiwarc and Alpha 
Logic Business Systetns have requested that we 
not print parameters for their copy programs 
(COMPUTIST is a registered owner of both). 
In conspliaiice with their requests, COMPUTIST 
hasn 't printed any such parameters since issue 
No. 4. 

On the other hand, the nice folks from Utilico^ 
Microware frequently supply us with para/neters 
specifically for the purpose of printing them. 
We feel that enough of our readers are 
interested in this information to warrant its 
publication. 



Black Rose Rebuttal 



The letter from Black Rose of Pirates Cove 
is disgusting. There is no defense for software 
piracy. It is stealing plain and simple. Mental 
midgets like Black Rose attempt to justify this 
stealing with some twisted have-have not logic 
when in fact there is no justification for stealing 
on any grounds. The argument diat multuiiiUion 
dollar corporations should never miss the little 
bit he steals just doesn't hold water. That's uo 
different than saying a department store won't 
miss the little item one shoplifts, or that cheating 
insurance companies is okay because they can 
afford it. Stealing is stealing. It doesn't matter 
if Black Rose breaks into his (her?) neighbor's 
home and takes their belongings or if Blackie 
takes or gives an unauthorized copy of software, 
it is stUl stealing plain and simple. 

Black Rose should check his madi. I don't 
know how accurate his information on software 
revenues are, but 20-50 million stolen through 
software, piracy is about 9-20% of 250 million, 
not l/50&th, I wonder how Black Rose would 
feel if a few thousand people were stealing 
9-20% of his annual pre-tax salary every year? 
I'll bet he would sing a different tune, I don't 
blame Black Rose for not signing his real name. 
I wouldn't either if I were a low-life criminal 
like him. 

As long as people like Black Rose are 
around, those of us who are honest consumers 
win have to pay for his disgusting crimina] acts 
through higher software prices. As for myself, 
I buy unprotected software whenever possible. 
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Beagle Bros. , Apple, Roger Wagner, and some 
other very good companies now sell software 
which is unprotected. Unfortunately, there are 
some very good programs that are not free of 
copy protection, lilce Print Shop, Sargon UI, 
etc. If I knew Black Rose personally, I would 
inform the software manufacturers whose 
produets he was stealing and offer to testify 
against him in court if they wisiied to prosecute. 
Unfortunately the cost of prosecuting petty low- 
iifes like Black Rose makes ii unlikely that he 
will ever be punished. 

Donald G. Moses 
Incline Village, NV 



Milliken Softkey 

I have a softkey for the Milliken Math 
Sequences. The program that I worked out the 
following softkey for is the fractions program. 

Materials: 

One blank diskette 

COPYA from system naaster diskette 

Sector Editor of some type 

MASTER CREATE from system master 

diskette 

Procedure: 

1) Boot up the COPYA program. 
RUN COl'YA 

2) When you are asked for the source slot press 
CTRL-RESET. 

3) Enter the monitor and override all DOS eiror 
checking, 

CALHSl 
B942:l« 

4) Return to BASIC 

ED 

5) Delete line 70 of COPYA 

7B 

6) Run COPYA and follow normal procedures 
for making a copy. 

RUN 

7) When the copy is completed RUN your 
sector editor and change the first two bytes of 
track $11, sector 0, from A0 Fl to 04 U, 

8) BRUN MASTER CREATE (on System 
Master diskette). The greetii^ program should 
be called "BOOT". 



You should now have a working copy, 

William S- Hughes 
Indian Head, MD 



APT Plus Adventure Tip 

Here is what I think might be considered an 
APT for chopliftcr. It allows you to play 
forever, unless you get yourself killed. 

Land beside some of the men, but do not let 
them get inside of your helicopter. Take off and 
land about half a screen away. Wait till men 
the get as near to the helicopter as possible 
widiout boarding it, and then repeat the process. 

When you get to your base, tlie computer will 
not count the man as having arrived at the base. 
Because of this, there will be oidy 63 men left, 
but tlie computer thinks there are 64 left. The 
computer will not be able to know if all 64 have 
died. Because of this you can play as long as 
you can survive, not worrying about the men. 
I use this so that I can practice killing tanks and 
planes. Maybe someone can figure out why this 
happens? 

A] so, here are some adventure tips for 
perhaps the weirdest advennire game ever 
made, MINDWHEEL, 

Don't cast the copy of the fear sonnet aside, 
use your sense. If you feel Ihe game is depriving 
you of seeing the images of other minds, like 
the tyranny of the Generalissmo, or the night 
in the courtyard, cheer up! AH the answers to 
the fear sonnet are in die last two sentences. 

That pinecone fiL<! perfectly into the door at 
the entrance into Eva Feins mind, but that's not 
all it takes to open the door. 

Finally, some people have asked me how I 
get these adventure tips. It's very easy. First 
take a formatted disk and save your game on 
it. You should save it when you're on the side 
you wish to examine. Then take out a sector 
editor, and look at Track fl. All that garbage 
is what tells the program what was happening 
at the time you aavc the game. Try changing 
most of the data (PAST SECTORS 1 AND 2) 
to FFs. Next, try to RESUME NOVEL. If you 
get a BOOKMARK ABORTED message, you 
were to curious and messed up some important 
smff. Your screen should start filling with every 
possible rae,?sage the program could ever give 
you. Stop it with ESC so that you have time 
to read it. This should give you some info on 
the inner workings of the game. 

I am currently woking on decoding the way 
this information is stored I'll write soon with 
more infoimation on the subject. 

Ben Yongdah] 
SiouK Falls, SD 



Most 

Wanted 

List 

Need help 

backing-up a particularly 

stubborn program? 

Send us the name of the program and its 
manufacturer and we1t add it to our Most 
Wanted Ijst, acdumn (updated each issue) 
which helps to keep COMPUTIST readers 
informed of the programs fur which softkeys 
are MOST needed. Send your requests to; 



COMPUTIST 

Wanted List 

PC Box I10846-K 

Tacoma. WA 98411 



If you know how to deprotect 

unlock, or mc>dlfy 
any of the programs below, 
let us know. You'll be helping your fdbw 
COMPUTIST readers and earning MONEY 
at the same time, S«nd the information to 
us in article form on a DOS 3.3 diskette. 



Mouse Ca!c Apple Coitlpuler 

Ajjplo Busineifs C^apttics Apple Coimpuler 

Fltght Slmirlaior n Sub Logic 

Parfiiry Sunburnt C^mmunicaling 

Jane Arkrrrinlcs 

Vislblend MicroUb 

Lif^^saver Microlab 

Catalyst Quark, Inc. 

Gulenbur^ Jr. & St. Micromation LTD 

Prime Motter Primesoft Corp. 

Zardax Computer Soluiinns 

Th» Handlers Silicon Valley Systems 

The Apple's Care; Parts 1-3 Tlie Professor 

KiriK's Quest Sierra On-line 

Fiui Kuneh Unicom 

Willy Byte ... Data Trek 

Trivia Fever Professianal Software Int 

Tcrrapltj Logo \ZM Terrapin Software 

'Ilie BvsluD Computer Diet Scariwrough Systems 

Cunun Datasoft 

Cycloid Sirius Software 

Crisis Mountain Synergistic SoRware 

Arlvcnture Microsoit 

Agifnt 11. S, A, Scholaauc 
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readers' «of tkey & copy exchange 



Ken Black's softkey for.. 



Algebra Series 



Edu-Ware Services, Inc. 

P.O. Box 22222 

Agoum, CA 9130} 

Requirements: 

Apple ][ 
COPYA or FID 
A blank disk 

As almost everyone knows, educational 
software gets lots of abuse from curious little 
fingers. The Algebra series of disks from Edu- 
Ware are a good teaching aid and provide 
enough screen graphics to keep you on course 
through tlie lessons provided. Very lucky are 
we, that the backups are simpk and easy and 
can save us our valuable original. I have the 
entire series of these disks and have found this 
procedure to work on all of them. I aJso believe 
that this will work on any of Edu-Ware 's odier 
programs. 

The protection on this disk is rather simple 
in that Ihe disk is in a normal format except that 
the address and data epilogues are changed. Tt 
t;an be CATALOGed by defeating DOS's error 
checking. This means we can probably use FID 
or COPYA to transfer the files. It wiil be faster 
to use COPYA to copy the disk and add a 
proper DOS laser. 

The Procedure 

1) Get out COPYA and RUN it. 

2) When it asks for the drive numbers, break 
out o f the program by typing 

ES. 

3) Enter the monitor and defeat DOS's error 
checking. 

CALL-151 
n942:18 

4) Return to BASIC and delete line 70 (to avoid 
reloading the machine language part). 
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5) Restart COPYA and copy the Algebra disk 
to a blank disk. 

6) Now put a normal (or fast) DOS on the new 
disk using MASTER CREATE or a similar 
utility, following the instructions. 

You now have a backup of your delicate 
educational disk. I highly recommend a fast 
DOS to speed tlie program along. It makes a 



great deal of difference. Otherwise, class may 
be over before the boot is finished . 

£ 



Ken Black's softkey for. 



Time is Money 



Turning Point Software 

IIA Main St. 
Watenown, MA &2I72 

Requirements; 

Apple J[ 

Super lOB 1.5 

A blank disk 

nie following are optional: 

A disk search program 

A sector editor 

A copy program that can skip tracks or ignore 

errors 

Time is Money is another home accounting 
program that is rather simple to use and has 
some cuce features. As with all programs of this 
type you must boot the original to get the 
program going even if you have a data disk. 
This could lead to premature disk failure, so 
I decided to make a backup to keep the original 
in safe condition. My attempts to make a backup 
didn't go too well. Even COPYA seemed to 
work up to a point. After doing some checking 
I found that the problem was with track $22. 
It just didn't want to copy. Some of the time 
the copy would boot but the message "Not 
Master Disk" would appear and the program 
would go no further. Fortunately, the disk can 
be softkey ed rather easily. 

The Protection 

This disk appears to use a normal DOS 3.3 
format up to track $22. It will copy fine to that 
point. Track $22 contains nothing but SET bytes 
and some markers. If diis strange track isn't 
there we get the nice message about the disk. 
What we need to do here is make tliis track in 
a normal format like the others and find the 
check routine and disable it. 

In track 5, sector SF, there is a routine that 
accesses the disk. Look for the bytes $BD 80 
C(S. This translates to LDA C0RC,X, which 
readii a byte off the disk. This is unusual, 
because it is not a track DOS usually resides 
on {a clue!). Replacing tlie LDA (SBD) with 
an RTS ($60) sometimes works because the 
protection code may simply exit with the carry 



flag changed, if the desired data was not found. 
In this case, store a $60 at byte $19 (on your 
new backup) and you will have a working copy. 

The Procedure 

Note: the version number of this Time Is 
Money disk was "1.0 F". 

1) Try to catalog the original Time Is Money 
disk and make a note of the disk volume 
number. Don't forget to write protect the 
original. 

2) Put the Super lOB controller below into 
Super JOB !.5- 

3) Start the program and let it format the blank 
disk with Uie same volume number as the 
original. 

4) Copy tracks 0-$2 1 of Time Is Money . Super 
lOB will do the sector edit for you. 

If that doesn't work, you might want to try 
this: 

1) Initialize a blank disk (with the original's 
volume number). 

2) Copy the original to ihe backup with the 
exception of the strange track. 

3) With a disk searcher, look for the bytes BD 
8C C0. The one you want is probably not in 
tracks 0-2. Replace the most likely one (in this 
case it was at byte $ 19, track 5, sector $F) with 
a $6ft, or maybe a $18 60, and write it back 
to the copy. 

You should now be die proud owner of a 
COPYAable, fiilly flinctional, backup that you 
can use without the worry of damage to th& 
original. Now can anyone tell me why my 
account is so empty? 



controller 



1000 REM TIME IS HONEY COimOLLER 

1010TK = :LT = 34 ;ST= 15 :LS = 15 :CD=WR iFASff 

= 1 
11320 SOSUB 490 : GOSUB610 :T1=TK :TK=PEEH{TRK 

) -1 : RESTORE : GOSUB 310 :TK = T1 
1030 GOSUB 490 : GOSUB 610 : IF PEEK (IRK ) = LT 

THEN 1050 
1 040 TK= PEEK (TRK) :ST = PEEK (SCT ) : GOTO 1020 
1050 HOME ; PR I NT "COFVCiONE" ; END 
1100 DATA 1^ CHANGES ,5 ,15 ,25 .96 



controller checksums 



- S356B 

1010 - S07i5 

1020 - $CE56 

1030 - i7CE8 



1040 - SDICC 
1050 - SB5D7 
1100 - $9860 



t 
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readers' softkey & copy exchange 



A.L. Eeai, Jr.'s softkey for. 



Pitstop 11 



EPYX 

1043 Kiel Q. 

Sunnyvale. CA 94089 

Requirements: 

48K Apple ][ 
Super lOB vl,5 
A blank disk 
DOS 3.3 Master 
Pitstop 11 

Pitstop n is a racing game with outstanding 
hi- res graphics. A joystick facilitates the play 
of the game. Examination of the disk using a 
nibble editor shows that Epyx lias changed the 
address and data epilogues from $DE $AA to 
$FF $FF. The checksums are all standard. 
First, I decided to see if I could read the tracks 
anil sectors by patching DOS for the epilogue 
changes that I found. This worked fine using 
the Tricky Dick or Copy n Plus sector editors. 
There appeared to be no code on tracks $03 
through $10 alttiough someone'^ name, address 
and telephone number are written to track $06, 
sector S09. Also, track SflA, sector $05 appears 
to contain bytes that could be used by a nibble 
count routine. 

Examination of track $1 1 shows a standard 
DOS 3.3 VTOC, The one and only catalog 
sector is located at track .f 11, sector $0F in its 
standard position. One binary file, BOOT, is 
listed, a rather descriptive name. This fde has 
a length of $FF bytes and is loaded at $4000 
in memory. At this point I decided to make a 
copy. 1 first used the manual sector copy from 
Copy n Pius and changed parameter.^ 5C, 5D, 
66 and 67 to change the wanted epilogue bytcii 
for the addre.ts and data epilogues. This copy 
would not boot but wouid clear memory, 
recalibrate and try again. This indicated that 
there is probably a signature check or a nibble 
count routine contained in the initial boot stage. 

On a hunch 1 decided to replace DOS on the 
disk with a standard DOS 3,3, patch it to ignore 
epilogue checks and see if I could BRUN 
BOOT. It worked like a charm. Just to see what 
was going on, I next installed the The CIA 
Tracker, patched DOS in memory and BRUN 
BOOT. After accessing tracks $11, $12, and 
$13, the hi- res display comes on, eliminating 
the text window diat the Tracker uses. From 
there, I couldn't watch the tracks it accessed. 



1 then BLOADcd BOOT into memory and 
examined the code beginning at $4000. The 
graphics mode and pages arc set beginning at 
$40eD. I NOPped all of these with $EA's in 
memory and then gave the command $4000G. 
The diange killed the hi-r^ display and allowed 
the Tracker to display the tracks and sectors 
accessed. Restarting, Tracker revealed that the 
BOOT program loads me game directly into 
memory from tracks $16- $22, Furdier study 
found the entry point for the game Is at $0AM. 
Tracks $14 and $15 are empty. 

The Softkey 

The plan will be to initialize a blank disk with 
DOS 3.3 (or similar) and use Super lOB 1.5 
to normalize tracks $03 tlirough $22. Ai this 
point you could simply BRUN BOOT and start 
the game, but that's not good enough. A better 
way would be to patch DOS to BRUN BOOT 
instead of trying to RUN it. 

1) Boot up your DOS 3.3 master. 

2) Fix DOS to BRUN (instead of RUN) the 
hello program. 

9E42:34 



3) Initialize the blank disk with the modified 
DOS and "BOOT" for die filename. 

INITBOOT 



4) Install the controller below into Super lOB 
1.5. RUN Super lOB but do not format the 
target disk. Super lOB will copy tracks $3-$22 

to the new disk. 

I 

5) Have fun with your COPYAahle Pitstop n. 



contrnller 



1000 REH PITSTOP II CONTROLLER 

101BTK = 3;LT = 35:ST = 15:LS=15 :CD=WR:FAST 

= 1 
1020 GOSUB 430 : RESTORE ; GOSUB 170 ; GOSyB610 
1030 GOSUB 490 : GOSUB 230 : GOSUB 610 : IF PEEK 

<TRK ) = LT THEN 1050 
1 040 TK = PEEK (TRK) :ST=PEEK (SCT) ; GOTO 1020 
1050 HOME : PRINT "THAT'S' ALL' FOLKS" : END 
5000 DATA '255 ,2S5 ,255 ,255 



coDtroUer checksums 



1000 - S356B 

1010 - $2445 

1020 - SF471 

1030 - iA55A 



1040 - $43C5 
1050 - J8445 
5000 - $3Bia 



£ 




TIME 



24 SPEED i£i 



FUEL 




£4 SPEED 136 



py^l^ nnncmxinniQOi 
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readers' softk ey A copy exchange 



Ken Black's sojjkey for,. 



Track Sector B/te From To: 



Apventure to Atlantis 



Synergistic Software 
830 N. Riverside Dr. 

Suite 201 
Retmn, WA 98055 

Requirements; 

At least 48K 
A blank disk 
COPYA or similar 
A sector editor 

It seems that tiiis game is still rather popular. 
It offers good action, and requires some 
thinking to complete. This game requires some 
time to complete especially at the harder levels. 
Since using originais is a no-no we shall make 
a backup copy. 

My attempts with a bit copier lead to bad 
copies time after time. Thank goodness it's 
easier to softkey than bit copy. 

The Protection 

It seems that tlic only protection on this disk 
is a protected DOS. The address and data 
epilogues have both been altered to E2 AA. The 
DOS appears to be an abbreviated form, in 
which only the RWTS and a few commands 
exist. This is probably because the disk is very 
full of program data. To put a full size DOS 
on the disk would require making room in extra 
tracks, and the catalog. The easiest softkey is 
to simp]y copy the disk with COPYA and fix 
the DOS so that it reads normal epilogues. All 
eSse on the disk is fairly normal. I^'s press on 
and backup this popular game. 

The Procedure 

1) Boot a normal DOS. 

2) Defeat DOS's error checking so thM it will 
ignore the different epilogs, 

CALL-151 
B942:18 

3) RUN COPYA and copy the disk. 

4) Reboot DOS and start up your trusty old 
sector editor. 

5) Perform the following sector edits to your 
new backup. 



$3 


i35 


$E2 


?DE 


$3 


S91 


m 


IDE 


n 


$9E 


$E2 


IDE 


$G 


$AE 


$E2 


$DE 



Your disk should now boot and work 
properly. Put the original away rarf use the copy 
with peace of mind. 

s 



Ken Black's softkey for,. 




Uhrasofl. Inc. 

250P 152nd Ave, N.E., Ste. E 

Redmond, WA 98052 

Requirements: 

Apple ][ 

COPYA 

A sector editor 

two blank disk sides 

Serpent's Star is one of the animated 
adventure games from Ultrasoft Inc. The reason 
I got it was that I had their other release "Mask 
of the Sun", and liked it very much. One of 
the things I noticed when I opened the package 
was that it had a note in it that said "DO NOT 
WRITK PROTECT". The protection scheme 
reads and writes to die disk as part of the 
protection. One note that cannot be overstated 
is that this program (and any program that alters 
the disk's surface) needs to be backed up to 
prevent damage to your disk drive head. You 
heard right, the disk drive head. Get your disk 
and hold it up to the light and turn die disk inside 
the jacket. At one point on the disk you will 
see a hole in the disk. The protection writes to 
the known location of the hole and if valid data 
is read back from that location, it knows that 
the hole isn't there. In other words, it expects 
a bad disk, or it won't boot. Part of my worries 
were concerned with that hole in the disk and 



what it would do to the read/write head on my 
disk drive. Enough passes of this rough surface 
on a read/write head will cause problems after 
a while. Since Howard Hughes I'm not, and 
service is expensive, I beg you to transfer this 
disk as soon as possible to a normal one. Disk 
drive parts aren't cheap! 

Besides the hole in die disk, it seems that only 
the epilog bytes liave been changed. Of course, 
the little message enclosed with the program 
telling about the protection scheme lets us know 
diat there is more involved. We will copy tlie 
disk with COPYA, ignoring errors of course, 
and disable the test for the hole. 

The Procedure 

1) Boot normal DOS 3.3. 

2) Enter the monitor and defeat DOS's read^ 
error checking. 

CALL-ISI 

3) Get out your disk with COPYA and RUN it. 

4) Copy both sides of the disk to your blank. 

5) Get out your sector editor and make the 
following changes to the boot side, 

TRACK SECTOR BYTE FROM TO 






3 


42 


38 


18 


2 


C 


41 


9D 


EA 


2 


C 


42 


8F 


EA 


1 


c 


43 


CO 


EA 



Now you should be able boot your copy 
without the write protect notch covered. It 
seems that somewhere in the file "LL(V27)" 
there is stiU something that checks for the 
read/write protection. This way works vrell for 
me, a,^ the save game feature stiU works, whUe 
it may not in other backup procedures. You 
should notice that if it is write protected the disk 
wilt boot over and over. Good luck with the 
search for the missing scrolls. 
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UCtiinalV 



by Mike Roetman 



Vhima W 

Origin Systeivs, Inc. 
340 Harvey Road 
Manchester, NH 03103 



Requirements: 

Apple ][ with 64K 
Ultima IV 
Super lOB vl.5 

The crunch of sword against Ore bone is 
heard again in llie realm of Lord British. The 
adventurers have returned to the largest, most 
sophisticated Ultima yet encountered. 
"ULTIMA rV: Quest of the Avatar" is a fun 
game to play, and a ftin game to deprotect. 

The Protection 

Only Side A of Ultima FV has been protected. 
The other three disk sides can be backcd-up 
with COPYA, and are accessahle with normal 
DOS 3.3. After implementing this softkey the 
program disk wiU be just as open. 

Origin Systems employs several schemes 
famiiar to most readers of COMPUTIST. The 
addre.is prologues are changed and are ditfcrent 
on ahnosi every track. On most tracks the data 
prologues are a non-standard D5 AA B5. The 
address epilogues are altered and change sector 
by sector; the pre-address fleid sync bytes are 
DB instead of FF; and, tlie RWTS translate 
tables are not norma]. 

Normal RWTS Translate Tables 

Not all jwssiblc byte values can be read by 
the disk drive. Hardware restrictions limit the 
number of valid eight-bit bytes on the disk to 
only 66, two of which arc reserved. In order 
to get around this limitation, DOS breaks up 
the 256 bytes to be stored in a sector into 342 
bytes in a process called nibbiliration. Each of 



these 342 bytes has one of only 64 possible 
values from $00 to $3F. Since these 64 
nibbilized values are not tlie 64 disk readable 
values, DOS uses the write translate table to 
convert the nibbilized data to disk valid bytes. 
For example, if the nibbilized byte is $00 the 
value $96 is acmally written on the disk. 

That which is coded must he decoded, and 
DOS has made provisions for this in the form 
of the read translate table. This table is used 
to convert disk bytes back to nibbilized form. 
To continue our example, the disk value of $96 
is translated by DOS back to $00. 

Altered RWTS Translate Tables 

An altered, protected DOS can be created by 
changing just one byte on each of the translate 
tabies. For instance, changing the first byte of 
the Write Table to SAA will set $00 = $AA 
instead of $96. To read this disk properly the 
2ist byte (decimal) of the Read Table must be 
set equal to $00, making .^AA = $00 instead 
of $AA, The Read Translate Table value $96 
= $00 docs not have to be changed. The value 
$96 will never be read from the altered disk 
because it wiU never be written to the altered 
disk. Normal DOS will make no sense of this 
disk's data vi/hen it translates $AA as $AA. 

There are two tipoffs that Ultima IV may use 
an altered translate table. First, when snooping 
through the original disk using The CIA 
program with altered sector marks, some of the 
sectors have invalid DATA checksums. Second, 
in track $11 a few sectors are normal, empty 
catalog sectors. Other sectors appear as outlines 
of normal catalog entries written in gibberish. 
Both of these findings can be caused by table 
alterations. 

Nest, it must be determined exactly what 
change has been made in the translate table. 
Sometimes the translate table is visible in the 
DOS, and it becomes an easy matter to find out 
what has been done by comparing it to the 
nomial table. Unfortunately, Ultima FY's DOS 
is so heavily encrypted that this method does 
not work. 

Random substitution can ttc tried. This is not 
asmuchof a longshot as it first appears. Since 
AA and D5 arc valid (but reserved) bytes, most 
such changes involve substituting either AA or 



D5 for a normal value in the table. With two 
values to try in each position of the table, there 
are 128 likely changes to look for, A fbnnidable 
task, but not impossible. The CIA's "Code 
Breaker" utility is a great help in such an 
undertaking. Success is determined by valid 
checksum reading of the disk and a normal 
catalog. 

A more scientific method is to follow the 
steps that DOS uses to encode the data and find 
the variance. Sector $i 1/$0E of the Ultima IV 
program disk looks like a "funny" catalog 
sector. If this were a normal catalog sector the 
first four bytes would be "00 11 0D 00". The 
nibbilized version of these normal bytes is 
basically W 07 03 00". Exactly how to 
nibbilize the data is beyond the scope of this 
article; "Beneath Apple DOS" by Worth and 
Lcchner explains the procedure. The nibbilized 
data is normally converted to ' '9D A6 9B 96' ' 
by the write translate table and written on 
physical sector $1 1/$&4 starting at the 87th byte 
(decimal) after the data prologue, A raw nibble 
dump of the protected disk shows that "9D A6 
D5 96" is written here instead. This means that 
nibbilized value $03 i.s being translated as $D5 
instead of $9B by the Ultima IV write translate 
table and $D5 must become $03 on the altered 
read translate tabic. 

TItc lOB I 

Sometimes the old methods work the best. 
The original SUPER lOB simply ignored 
epUogue bytes In subroutine 170. SUPER lOB 
vl.5 requires that the altered epilogue values 
be entered as DATA statements. Since the 
address epilogue in Ultima IV changes with 
each sector (512 changes on the disk), it is 
easier to just ignore the epUoguc bytes. A long 
list of DATA statements is still needed because 
the address prologue changes track by track. 

To compensate for the altered Translate 
Tabies the D5 = D5 on the Read Translate 
Table must be changed to D5 =03. This is 
accomplished by the POKE 47829,3 in the 
controller. POKE 47829,213 normalizes the 
table. The write translate table does not need 
to be changed because we are never writing to 
the original disk. 



m 
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Clean Up Details 

After you complete your copy, patch a DOS 
onto the disk. A fast DOS is preferable. Write 
an Applesoft HELLO program that ends with 
the statement: 

PRINT CHRJ(4) "BRUN IBSNIT" 
and save this to the new disk. 

A few modifications are still needed to make 
the normal RWTS routine fiiily compatible with 
Ultima IV. To accomplish these BLOAD 
S KBAI UBS, ma ke the changes found in table 
1, and BSAVE S^^ UBS, AS&sm, L$180O. 
Or change these values directly on the disk at 
Track $12, Sector $B9 with a sector editor. 

Have Fun 

Ultima rV is a pleasure to play. It should be 
in every adventure gamers library . Buy it, back 
it up, enjoy it. 

And when you are playing your next 
"Copy the Disk" game, don't forget about the 
translate tables. They may hold the key you arc 
looking for. 

Step by Step 

1) INITialize a disk preferably with a fast DOS . 

IKIT HELLO 

2) Install the controller at the end of this article 
into your copy of Super lOB v 1 .5 and RUN it, 

3) Type iti diis short program. 
10PRINTCHfi$(4) "BRUN llBaNlT" 



4) Save this program as HELLO to your copy 
of Ultima iV. 

SAVE HELLO 

5) Load in the file called S^S UBS, 

CALL -151 
BLOAD SESlJBS 

6) Make the changes found in the foUowing 
table to the file. 

Table 1 

LOCATION FROM TO 

0A9F 80 EA 

0AA0 5D EA 

0AA1 BD EA 



0AA4 ao 

0AA5 2C 
0AA6 BF 


EA 
EA 
EA 


0AA8 E8 
0AAA B7 


B7 
E8 


7) Save this modified program to your disk. 
BSAVE SBSUBS, AM8M, L$i8W) 


That's it! 





controller 



1020 POKE 4 7406 


,24 


POKE4740G.96: 


POKE 47497 


5250 DATA 221 


,170,158 






,24; POKE 47498 ,96 






5260 DATA 221 


,170,159 






1030 P0KE47829,3:Tl=TK:GOSUB 490 


: GOSUB 210 


5270 DATA 223 


,170,158 






1040 GOSUB 190 : GOSUB 610 






6280 DATA 223 


,170,159 






1050 TK = TK + 1 : LT = LT + I : IF PEEK {BUF ) < 


MB 


5290 DATA 221 


.170 ,158 






AND TK< 35 THEN 1040 






5300 DATA 221 


,170,159 






1060 POKE 47405 ,208 : POKE 47406 


.19 : POKE 


5310 DATA 223 


,170,158 






47497 ,203 ; POKE 47498 ,183 : 


POKE 47829, 


5320 DATA 213 


,170 ,181 






Z\3 : GOSUB 230 






5330 DATA 223 


,170,159 






1070TK = T1 :LT = 35 : GOSUB 490 : GOSUB 610 ; 


IF 


5340 DATA 245 


,170 ,182 






PEEK (TRK) = LT THEN 1090 






5350 DATA 245 


,170,183 






1080 TK = PEEK (TRK) ;ST = PEEK (SCT ) :LT = 


TK 


5360 DATA 247 


,170.182 






+ 1 ; GOTO 1020 














1090 HOME : PRINT "COPYOONE," 

COPIED," :END 


DOS" NOT" 










controller checksums 


5000 DATA 213 170 .181 










5010 DATA 215 


170 


151 






1000 - 
1010 - 


$356B 
13189 


5140 
5150 


- $690B 

- $0DF7 


5020 DATA 213 


170 


150 . 






1020 - 


$C562 


5160 


- $9708 


5030 DATA 213 


170 


151 






1030 - 


$545E 


5170 


- $£228 


5040 DATA 215 


170 


150 






1040 - 


JDDB4 


5180 


- $B79F 


5050 DATA 215 


170 


151 






1050 - 


?A5C8 


5190 


- $S024 


5060 DATA 221 


170 


158 






1060 - 


J46F2 


5200 


- $AD98 


5070 DATA 221 


170 


159 






1070 - 


$DE82 


5210 


- $CCE4 


5080 DATA 213 


170 


ISl 






1080 - 


$3CF1 


5220 


- $2D67 


5090 DATA 223 


170 


158 






1090 - 


I8C6A 


5230 


- $CE20 


5100 DATA 223 


170 


169 






5000 - 


$7F44 


5240 


- $D255 


5110 DATA 221 


170 


158 






5BI0 - 


$A7De 


5250 


- $531D 


5120 DATA 221 


170 


159 






5020 - 


$3759 


5250 


- $4460 


5130 DATA 223 


170 


158 






5030 - 


$A9EE 


5270 


- $97AC 


5140 DATA 223 


170 


159 






5040 - 


$355C 


5280 


- $DCF9 


5150 DATA 213 
5160 DATA 213 


170 
170 


150 
181 






5050 - 
5060 - 
6070 - 


JC914 

IE02F 
$BBA0 


5290 
5300 
5310 


- S1B35 

- $4A59 

- $E57C 


5170 DATA 213 


170 


151 






5080 - 


IF498 


5320 


- I199F 


51BB DATA 215 


170 


150 






5090 - 


$F49E 


5330 


- $0058 


5190 DATA 215 


170 


151 






5100 - 


sFEae 


5340 


- $BEF8 


5200 DATA 213 


170 


150 






5110 - 


$FA81 


5350 


- $3174 


5210 DATA 213 


170 


151 






5120 - 


19946 


5360 


- S8E91 


5220 DATA 215 


170 


150 






5130 - 


54834 






6230 DATA 215 


170 


151 












^f- 


5240 DATA 213 


170 


181 












s 












^^V!^l 


I 


HnS 


ss 


1 




n 


■ 


i!B< 



__'" Origin svstems,inc. ^ 

PRESENT 

Uitin)a.11 

<iy€$T OF TR€ flyflTflft 



1000 REM ULTIMA IV 
1010TK = 3:LT = 4 ;ST: 



15 :LS=15 :CD = HR 
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ROBOT ODYSSEY 



By Steve Luzietti 



TTie Learning Company 

545 MiddkfieM Road. Suite #770 

Mcnli) Park. CA 94025 

$49.95 



Requirements: 

64K Apple ]I Plus and up 

COPYA 

A sectoi' editor 

A double-sided blank disk 

(or two single sided blank disks) 

Robot Odyssey I 

Robot Odyssey is an excellent educational 
program from the same compiiny that brought 
us Rocky's Boots. It offers instruction 
encompassing electrical engineering 
fundamentals, digital logic, and circuit design 
all in a neat, easy-to-use and entertaining hi- 
res package! Unfortunately, (or fortunately for 
us challenge-seeking deprotectors) the program 
does have one major drawback: copy 
protection, and a sneaky one at that. 

The disk itself is formatted in a slightly 
altered DOS 3,3 format. The only modifications 
are that both the address field and data field 
epilogues are changed from DE AA to FF FF. 
This can be easily defeated by turning off DOS 
3.3's epilogue checksum, B942:I8 in the 
monitor (I'm sure by now you've seen this so 
many times that you probably recite those 
mystical numbers in your sleep); reading from 
the disk in this altered format; turning the 
epilogue checksum back on. B942:38 in the 
monitor: and writing to your copy disk in 



standard format. This normalization process can 
be easily accomplished with a slightly modified 
COPYA. 

If you boot the normalized copy of Robot 
Odyssey, everything seems to function 
properly. The disk boots fme. the program 
loads its different portions correctly, and 
everything seems OK until you try to use the 
soldering iron. The soldering iron will not 
workl This is really a nasty trick done by the 
protectors, since the operation of the soldering 
iron is an integral part of the program. This 
"'malfunction" clues us in on another bit of 
protection, probably a check done by the 
program for the original disk, either during the 
boot or during the loading of a program 
segment. After booting the disk and breaking 
into the monitor during the title page display. 
I found some suspicious-looking ponions of 
code in memory pages $5D and $62: two disk- 
cheeking routines. 

The disk-checking routines at memory 
locations $5D4F-5DD5 and S6268-62EE are 
essentially the same. The code looks for certain 
bytes on the disk and if these bytes are not 
found. Lhe code branches to an "'error handler" 
(I'or lack of a better tenn) at SSDCE for the first 
routine or at $62E7 for the second routine. By 
analyzing the exiting conditions of the disk 
check, one may notice that if the disk checks 
out correctly, the carry bit is set, but if the di.sk 
check fails, the carry bit is cleared. For 
illustration purposes, here is a disassembly of 
the error handler code for the first routine. 

This portion of code will be executed if the 
disk checks out correctly. Note the SEC (set 
carry) and the branch to $,^DD3: 



5DCe- 
5DCC- 



38 

m 05 



SEC 

BCS $5DD3 



However, in the actual disk-accessing portion 
of the disk check, if cenain bytes are not found 
on the disk, the program will branch to the 



following code segment, in other words, the 
following code will be executed if the disk 
check fails. Note the CLC (clear carry): 



5DCE- 


C6 09 


DEC 


$09 


5DD0~ 


DO 97 


BNE 


(5D69 


3DD2- 


13 


CLC 




5DD3- 


BD 88 C0 


LDA 


sce88.x 


5DD6- 


5E FE 03 


ROR 


$03FE 



5DD9- 4C 00 40 JMP 



The only imponani condition on exiting from 
the disk check is the carry bit. This is the key 
for successfully cracking Roboi Odyssey. We 
must change the instructions at $5DD2 and 
$62EB (the latter is in the error handler for the 
second disk checking routine) from CLCs to 
SECs. So, in cookliook fa.shion: 

1) Load in COPYA. 
LOAD COPYA 

2) Add the following lines so that COPYA will 
ignore the address and data epilogues when 
reading but use them when writing. 

199 POKE 47426.24 
249 POKE 47426,56 
259 POKE 47426,56 

3) Type RUN and let COPYA load its object 
file. Copy both sides of the Robot Odyssey disk 
with the modified COPYA. 

4) Get your sector editor up and running and 
perform the following sector edits to both sides 
of the copy disk; 

Track Sector Byte From To 



S00 

$04 



$0F 
S0E 



SD2 S18 $38 
SEB $18 $38 



Thai's it! You now have a completely cracked 
and operational copy of Robot Odyssey. 

i 



^ 
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By The Nipper 



Rendeivoui 
Peachtree Software 
3445 Peachlree Road N.E. 
Adanta, CA 30326 



Requirements: 

Apple U with at least 4SK 
FID from the System Master 

Rendezvous is one of the high quality 
educational programs previrmsly handled by 
Eduware that is now distributed by Peachtree. 
It is a simuiation of the space shuttle takeoff 
and docking procedures and is an excellent way 
to introduce shidems to the laws of physics 
involved in space flight. 



Unfortunately Pcachrrcc has installed a new 
protection system that makes backing up 
Rendezvous very difficult. Further, Peachtree 
does not supply a backup, although they do 
offer a replacement policy. As any of you who 
work with cliildreii know, tlie first mle of 
computers is never give your original to a child. 
The difficulty in backing up Rendezvous led me 
to look for a method of deprotecting it. 

The Deprotection 

The first thing that I noticed was the small 
slip of paper that came with the program that 
said it would not boot if a language card was 
present. Sure enough, it wouldn't, So I took out 
my language card and booted up Copy ][+ 5,0 
to have a look at the address ant! data prologues 
and epilogues. The same thing can be done with 
any good nibble editor. The epilogs had been 
changed from DE AA to FF FF. 1 then booted 
up my sector editor and set it to ignore the 
epilogs and checksums. Everything went well 
until I tried to read any tmcfc other than zero. 



All I got was the dreaded I/O Error. I thea 
scanned the disk using the hi-res scan feamre 
(like in Locksmith 5,0). You could see extra 
white dots between the standard sync fields. 
Checking with the nibble editor si lowed sync 
bytes within the data fields. This is a sure 
indicator of a modified translation table. Since 
I couldn't capture it with my Integer language 
card, I tried to boot the disk into the extended 
80 -column card (see "Secret Weapon: 
Ramcard" by Ken Greenlaw, COMPUTIST 
No. 16), hut the program checked for that and 
wouldn't boot. 

Frustrated, I went off to bed dreading the 
thought of having to boot code trace the 
program to remove the protection. In the 
morning T remembered that any disk that uses 
modified RWTS does so only after sectors 
to 9 have been read in since ROM sets up a 
temporary set of tables, which is replaced by 
information on these sectors. With my sector 
editor patched, I read in track Q, sector 4 and 
looked at the nibble translate table which 




occupies bytC3 $29 to $S8. This is the table 
which is used to translate data in RAM to the 
disk. 

Instead of finding the standard start of 96 97 
9 A 1 found A A 97 9 A. A quick look revealed 
no other changes. So, the data had been written 
to the disk substituting AA for 96. The byte 
translate table occupies bytes $96 to SFF and 
is used to translate the bytes on the disk back 
into their original form in RAM, The value at 
SAA had been changed to $00 to match the 
change in the nibble translate table. The method 
for removing this protection was obvious. All 
that needed to be done was to modify a standard 
byte translate table (reading) to match the one 
used for Rendezvous while leaving the nibble 
translate tabic (writing) standard. Then if we 
patched DOS so that it ignored the epilogues, 
we could copy Rendezvous onto a standard 
disk. 

The Softkey 

1) Boot your DOS 3.3 system master. 



2) Reniove your system master and put in a 
blank disk. Initialize the disk with the name of 
the boot program on Rendezvous. 

INIT EDU-WARE 

3) Delete the boot program, 
DELETE EDU-WARE 

4) Put your system master back in the drive and 
run FID. 

BRUN FID 

5) Stop FID by pre.qsing Reset. 

6) Enter the monitor and alter the byte translate 
tabic so that it matches the one in Rendezvous. 

CALL- 151 
BAAA:ee 

7) Disable the address epilog check, 
B988:18 6ft 



8) Disable the data epilog check. 
B925:18 60 

9) Restart FID by calling its starting address. 
8«3G 

10) Copy all the files from the Rendezvous disk 
onto your initialized disk with FID. You should 
now have a broken version of Rendezvous. 

You will find that a number of the other Edu- 
Warc disks that are handled by Peachtree are 
handled in exactly the same way. I have found 
this to be the case widi Introduction to 
Counting, Spelling and Reading Primer, and 
Spelling Bee Games, Note that the files on 
Spelling Bee Games are too large to fit on a 
standartl disk, so you will have to patch your 
initialled disk to free up the sectors on track 
2 that DOS does not use. Change track $11 
sector 0. bytes $40 and $41 ftom $00 $00 to 
$FF $E0, 

Enjoy. 

ft 
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Attacking. 



Word Attack 



■,\ I 



,ii, 1 



by Dave Stanton 



Davidsnn & Associaies 

Groveuuk Place if 12 

RartfJio Pains Verdes, California 90274 

$49,95 each 



Requirements: 

Apple ][ Plus witli u way to reset into the 
monitor; or 128K //e, or lie. 
Blank disk(s) 
Super lOB vl.5 
Ciassmate, or Word Attack! 

Davidson & Asisociates offers well designed 
and effective software for the school and home 
market. Instead of the dazzling but often 
superfluous high-resoluiinn graphics offered by 
many educational publishers, this company 
combines sound teaching principles with a truly 
user- friendly programing style. The result is a 
simple elegance Uiat makes it easy for students 
and teachers to become comfortable with the 
software. 

For this achievement Davidson's offerings 
have received significant and just recognition, 
but in one way the company has failed to keep 
up with the pack. While many publishers now 
i include a backup or a one-backup copy-program 
with their disks, Davidson still follows the old 
practice of charging extra for a backup, which 
must be ordered by mail. Teachers, perhap.si 
better than others, know the problems dits 
system can cause. If a teacher is tn entrust his 
students' grades to "Classmate, ' ' for example, 
he must be certain that his data will not become 
inaccessible because of inadvertent damage to 
his original- not even for a shon time. 

In the interest of providing peace of mind to 
the purchasers of Davidson software, we 
embark on the adventure of deprotecting 



"Word Attack!" and "Classmate." No doubt 
the few hints offered here will provide 
encouragement and support to those who need 
to deprotect other programs from the same 
publisher. 

The Reconnaissance: 

The logical first step in backing up any 
program is to try COPY A- If that fails, 
commercial copy programs may work. Neither 
of these approaches creates a fitnctional copy 
of "Classmate" or "Word Attack!" 

Next, one mi ght tr y to halt the execution of 
a program with BD or Re.set so that the code, 
whether in Applesoft or machine language, can 
be analyzed and /or saved to a standard DOS 
disk. Sometimes opening the disk drive door 
at the right time works. Most copy-protected 
software uses a modified DOS which prevents 
effective breaking of the program with these 
methods. Both "Clasamate" and "Word 
Attack!" follow this tradition. 

How to load the protected DOS and stop its 
execution at will- that is the question. A copy 
card like Wildcard or Snapshot provides one 
answer, but we will use the method suggested 
in Ken Greenlaw's article "Secret Weapon: 
RAMcard" (Hardcore CO MPUTIST No. 16). 
To use this procedure, you must have an Apple 
lie or a lit with an extended 80 column card. 
You will also need the programs XFER.BOOT 
and RESTORE that diis mediod uses. If you 
have 128K, type in the XFER.BOOT hexdump 
(included here) and save it: 

BSAVE XFER.BOOT ,A$3»e,L$lA 

Then type in the RESTORE hexdump and save: 
BSAVE RESTORE,A$3(W,L$21 

Using Greenlaw's procedure does, in fact, 
allow us to capture and save the altered DOS 
from "Classmate," and the same one will work 
with "Word Attack!" and probably the otlier 
programs from Davidson, 

After you have INTTed a disk with the proper 
boot program, Super lOB 1.5 with the swap 



controller will put the deprotected files on your 
disk. You can now catalog the disk and load 
each of the files, most of which are written in 
Applesoft BASIC. 

Unfonunately, you will find that the 
programs do not run. Hidden in the code are 
a few lines that check for the original operating 
system. Those checks are simple but effective. 
We need to eliminate them, a simple process 
under normal conditions. 

However, you will find that many of the files 
on the "Classmate" and "Word Attack!" disks 
will not list after you have loaded them. Instead 
you will get REM, and nothing more. The 
programer has incorporated some type of 
control character into a few of the early REMs. 
That character terminates the list when 
encountered. By eliminating those lines cntiiely, 
you wUl be able to li.st and analyze the 
remaining lines. 

Now to find the protection lines. Unusual 
PEEKs and CALLs arc suspect, especially since 
most of the files are written in BASIC. It is good 
deprotection strategy to check your "Apple II 
Reference Manual" to determine what each of 
the suspect lines docs. The culprits must be 
expunged. As you wdl see in the procedure that 
follows, some of the files require no line 
deletions, while others require two or three such 
changes. 

Once the necessary changes have been matlc 
to each file, simply unlock the file on your copy 
and save the revised version over it. 

You may notice that WORD ATTACK] 
HELLO, a fde on "Word Attack!," has a very 
unusual list: 

10 POKE 104,32: RUN 
653S5 REM 
65355 REM 

No changes need he made to this file but if you 
wish to list it, POKE 104,32 in immediate 
mode. This sets the program pointer to the 
proper starting address. Now you can LIST 
normally. There is, however, another program 
hidden inside this one. Finding it offers a 
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or Classmate 



challenge, and although you need not 
understand this potential enemy weapon to copy 
"Word Attack!," you may find the same 
technique used on other disks. 

The Attack 

NOTE: In each step that requires deleting 
lines 9 and IB, you must delete the line before 
listing or running. 

1) INIT a new disk with "WORD ATTACK! 
HELLO." 

IIMT WORD ATTACK! HELLO 

For Classmate: 

miT CLASS 

2a) If you have a copy card or other way to pop 
into the monitor, then follow this step. Else, 
go to step 2b- Boot your original, and when the 
drive stops, stop the program. While In the 
monitor, Move the RWTS to safe memory: 

19M<B8M.BFFFM 

Boot a 48K slave disk with no HELLO program 
and skip to step 6. 

We now return you to our regularly 
scheduled article. 

2b) Assuming you have 12SK, Boot a normal 
DOS. Load in XFER.BOOT. 

PR#6 

BLOAD XFER.BOOT 

3) Put your original disk into the drive and boot 
it into upper memory. 

PR#3 
CALL768 

4) When the drive stops, hit Control-Reset. Go 
into the monitor to prepare for RESTORE and 
load RESTORE. 

CALL-151 
3F8: 4C M «3 
BLOAD RESTORE 



5) Move the trapjjcd RWTS into lower memury 
at $1900, 

19i»<B8«t.BFrFES 

6) Save the protected RWTS to the disk on 
which your Super lOB 1,5 is stored, 

BSAVE 

RWTS ,DAVIDSON,A$19«e,L$8»e 

7) Load Super lOB 1.5 and enter the swap 
controller listed below, RUN to make your 
copy. 

8) LOAD WORD ATTACK! and delete line 
0. Enter line 7 as shown. UNLOCK WORD 
ATTACK! and SAVE WORD ATTACK! 

7PRINTCHR$(4); ""HAXFILB 1 " ; GOSUE2170: 
GOSUB7780: GOSUB 7380 

9) LOAD WORD ATTACK! EDITOR. Delete 
line #5. UNLOCK WORD ATTACK! 
EDITOR, and SAVE WORD ATTACK! 
EDITOR. 

10) Copy the ' 'Word Attack! ' ' data disk with 
COPYA. 

The Attack of "Classmate'' 

1) hollow the steps for "Word Attack!" from 
step 1 to step 7. 

2) Load CLASS and delete lines 0, 10, and 40. 

3) Change line 250 as shown, and save the 
modified file. 

25« PRINT CHR${4);'RUN CLASSMATEl' 
UNLOCK CLASS 
SAVE CLASS 

4) Load CLASSMATE] and delete lines 0, I©, 
and 35. Save the new version of 
CLASSMATEl to the disk. 

5) Load CLASSMATE2 and delete Ones fl, 10, 
and 30- Save the modified CLASSMATE2 to 
disk. 



Victory: 

You should now have a perfecdy fimctioning, 
deprolecled copy of "Classmate" and/or 
"Word Attack!" Asabonu.';, ytw have a good 
start at deprotecting other programs from this 
publisher. 

XFER.BOOT and RESTORE lire reprinled 
from Issue No. 16 for your convenience. Refer 
to the original article for an explanation of what 
they do. 

XFER.BOOT 

0300; 20 i)3 FC 80 55 C0 8D 5F JFE02 

0308: C0 A9 00 80 ED 03 A9 C6 IFDDA 

0310: BD EE 03 IB 69 80 38 4C SACDC 

0318: U C3 SC571 



RESTORE 

0300: 18 20 11 C3 8D 09 C0 A6 $44AB 

0308: 67 A4 68 8D 08 C0 36 67 $9653 

0310: 84 68 8D 09 C0 Ae AF A4 ID830 

0318: B0 8D 08 C0 86 AF 84 B0 I6DU 

0320: 60 (ABDD 

controller 

1000 REM DAVIDSON CONTROLLER 

1010TK = 3 :LT=35 :ST = 15 :LS=15 ;CO=HR:FAST 

= 1 
1020 GOSUD 360 : GOSUB 490 : GOSUB 610 
1030 GOSUB 360 : GOSUE 490 : GOSUB 510 : IF PEEK 

(TRK) = LTTHEN 1050 
1040TK = PEEK(TRK) :ST = P£EK (SCT) :GOTO1020 
105eHO!^E : PRINT "COPY" DONE!" : END 
10010 PRINT CHR$ (4 ) "BLOAD" 

RVrrS. DAVIDSON. All 900" 

controller checksums 



1000 - $366B 

1010 - 12445 

1020 - SC90B 

1030 - SFB9C 



1040 - $0D4F 
1050 - SE40C 
10010 - SDCB4 
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Core revievrs... 



Fingerprint 



by Michael Sta^ord 



Thirdware Computer Products 
4747 NW 72nd Avenue 
Miami. FL 33166 



One of the biggest problems for readers of 
COMPUTIST magazine who own newer 
machines like the //e, is in finding an easy way 
to reset into die monitor from protected 
software. Many solutions have been offered, 
ranging from the exotic - burning your own 
custom ROM chips, to tlie more mundane - non- 
maskable mtermpt (NMl) cards (like Wildcani, 
Replay, etc.), or forcing a boot into the 
auxiliary RAM on 128K machines. I'd like to 
offer you yet another solution, which is 
essentially free - if you need a printer interface 
that is. It's called the Fingerprint Plus printer 
interface, manufactured by Thirdware 
Computer Products. 

I've been using this product for over six 
months now, and have been very impressed by 
it's performance. First of all, ii has both parallel 
and serial graphics capable interfaces on the 
same card, enabling you to run both a dot matrix 
and a letter quality printer off the same 
interface. In fact, you can print with both 
simultaneously if you like, The parallel portion 
of the board is Grappler+ compatible, and the 
serial portion is Apple Super Serial compatible. 
This insures almost universal software 
compatibility, no matter which output you 
choose, I've been using die interface with a 



Panasonic 1091 parallel printer, and haven't 
encountered any programs it did not function 
perfecdy willi, including Dazzle Draw, Fontrix, 
and even Mousepaini - although Mousepaim 
does require activating a special ROM routine 
first. 

All these feamres are very nice, but the thing 
that really distinguisheii this interface from the 
rest of the pack is an item that Thirdware calls 
an "activator" button. This button is a Ul inch 
flat wafer switch that is attached to the interface 
by a paper thin, mylar ribbon cable. You stick 
this adhesive backed switch on the case of your 
Apple, and thread the cable between the 
computer case and cover. The cable is so thin 
it doesn't interfere with die closing of the cover 
at all. 

Just as with any non-maskable interrupt card, 
pushing this button causes the program in 
memory to "freeze" - but there the similarity 
ends. Having pushed the button, die menu to 
the tight appears on your screen. 

As you can see, the menu is divided into two 
main parts. The smaller section, across the top, 
gives die main fiinctions of the Fingerprint Plus: 
Display, Print, Typewriter, and Jump, The 
larger section at the bottom lists 30 yes-or-no 
options. You move your cursor back and forth 
between the Function and Option sections by 
pressing the space bar. The left and right arrow 
keys move your cursor around die screen within 
die Function and Option sections, and the return 
key toggles yes or no foi' each option. 

At this point you have two main choices 
avadabie - if all you want to do is print your 
current screen, you just press the return key, 
and whatever was on your screen at the moment 
you pushed the "activator" button will be 
printed. No matter if it's text, graphics, or 



mixed mode, it will automatically be dumped 
to your printer. If however, you want to 
manipulate the contents of your screen, or 
perform some odier operation (Tike jumping into 
the inotutor!) you do so thru the menu. 

When you choose the Display function, you 
can preview/choose a particular screen available 
for printing: Hi-res pages 1 and 2, Text pages 
1 and 2, mixed mode, etc. 

Aftcr you've selected Uie screen you want, 
hitting the space bar returns you to the Print 
function. Press return at this point and whatever 
screen you have selected will dump to your 
printer. 

The Print function does just that - lets you 
print what you have selected through either the 
opdons menu, or the Display function. Hitting 
the space bar from die Print fimcdon sends you 
into the option menu, where you can change 
any of the print defaults, select die type of 
output - parcel, serial, or both, or even change 
the interface card dip switch settings! Once 
you've made your option selections, hitting the 
Space bar once again takes you back to die Print 
function, where pressing return wUl print using 
the options you've picked. 

Selecting the Typewriter function allows you 
to either use the keyboard like a typewriter (a 
la Applewriter), sending output direcfly to your 
printer, or you can send control commands 
directly to the interface card or your printer. 
The Fingerprint Plus command set (included in 
the manual), is more extensive than the option 
menu, even allowing you to change the serial 
output baud rate from the keyboard. 

Last, but certainly not least, is the Jump 
fiinction. Once you've selected this function, 
you press the space bar to enter the option 
menu, and pick which of the two jtmip option 
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Plus 



you want. The jump to FP RAM option 
activates any programs or routines that you 
had previously stored in the user-available 
RAM on the Fingerprint card. This can be 
a very powerful tool, limited only by tiie 
size of the RAM available, and your 
imaginalioti. At tlie time of this writing, 
the software program to load your routines 
into this user RAM 
was still not finished, 
but Thirdwarc 

assures mc it will be 
shipped shortly. 

The jump to 
monitor option, quite 
obviously, does just 
that - and is one of 
the main reasons I 
purchased this 
interface over the 
myriad of others on 
the market. All you 
do is push the 
"activator" button to 
freeze the program, 
hit the space bar to 
get into the Option 
menu, select the 
jump to monitor 
option, hit the space 
bar again to toggle 
back to the Function 
menu, select the 
Jump function, hit 
return, and you're in 
the monitor. It 
sounds like a lot of 
steps, but it's acmally 



quite quick and painless, and it certaitily 
beats buying an NMI card. 

If you have an external modem, or are 
thinking of acquiring one, it can be run off 
the serial output of the board. Third ware 
sells a special cable for this purpose, the 
cost of which is, I believe, $28.00. If you 
are not using the serial port for your 



printer, this can save you having to buy 
another interface board, and free up 
another slot in your computer as well. 

Third ware deserves a few kudos for 
their technical support of this product. I 
have had occasion to call them a few times 
with some questions, and have found their 



representatives 




OPTIONS: 

APPLE TEXT 
UIDEX 80 
STATUS SCREEN 
LINE FEED 
LEFT MARGIN 
LINE WIDTH 



PAGE NUMBER 
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SERIAL PORT " 
PARALLEL PORT 
DEFAULT SET 
JUMP TO MONITOR 
JUMP TO FP RAM 
LOCK 



GRAPH PAGE 1 
GRAPH PAGE 2 
DOUBLE HIRES 
LOW RES 
MIXED MODE 
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DOUBLE WIDTH 
ROTATE 90 
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COLOR 

BACKGROUND 
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to be extremely 
knowledgeable, and 
willing to go to great 
lengths to help you 
out. 

If there is anything 
T can find to criticize, 
it's the manual. All 
the information is 
there , but in spots it ' s 
rather sketchy, and 
on the whole it's 
crudely done. In 
fairness, I do have 
one of the earlier 
versions of the 
board, and it's 
possible the manual 
has since been 
improved. 

Current list price 
for the Fingerprint 
Plus is $149.00, 
although it's com- 
monly available mail 
order for $99.00, and 
lor that price, it's one 
of the best hardware 
bargains around. 
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BENEATH... 



Beyond ©fiSTLE 

ulfettatein 




parl2 



by Lars Grant-West 



Requirements: 

A broken copy of Beyond Castle Wolfenstein 
(or a way into the monitor) 
A desire to cheat 

After reading through Ray Darrah's article 
on the dc protect ion of Beyond Castle 
Wolfenstein (see "BENEATH Beyond Castle 
Wolfenstein," COMPUTIST No. 13, pg. 12) 
and following his instructions, I managed to 
make an unprotected copy of the game. I tried 
all of his APTs, and became so fascinated by 
the possibilities that I decided to go on from 
there and do a hit of experimenting on my own. 
After hours of poking around, the only thing 
I learned was to stay as far away as possible 
from memory location $4309, Not being one 
to take notes, I also don't have even an irikling 
of how I managed to transform all the guards 
into roaming Hitlers, and I doubt I could do it 
again if I tried. After repeated failure at making 
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any eardi shattering revelations, I decided to 
leave such experiniendng to the pros. 

Even though my searching didn't amount to 
much, 1 did come out of the experience with 
biit a few battle scars and a set of maps and 
charts that might make a helpful supplement to 
Mr. Darrah's article. 

Diagram 1: A map of the BEYOND 

CASTLE WOLFENSTEIN bunker. Although 
the appearance of the rooms may change, the 
basiclayout of the bunker does not. As you can 
see, each square or rootn on the map contains 
two sets of values. The top number is that of 
the room itself. This has no beating whatsoever 
on the function of the program, but can be used 
by you for reference. The bottom value is the 
hexadecidial number of the room, tliat which 
the computer understands. To move to another 
room, press Reset. You will find yourself in 
the monitor. As stated in Mr, Darrah's article, 
$4346 contains the room number. For example, 
to place yourself in the main guard room (#59), 
you would type (from die monitor); 

12!i4G 

Or, if you're even more daring, you can visit 
the royal goose-stepper himself by replacing the 
3B above with a 3C. Understand? 

Diagram 2: Player room coordinates. T^i.s 
chart gives you all sixty-four loc^ons that your 
spy can possibly go to in a room. Its use is 
similar to that of the bunker map from Diagram 
# 1 , but instead of going from room to room, 
you merely hop about the sicreen. To do this, 
you press Reset, and are, once again, in the 
monitor. To jump to, say, the upper left hand 
corner of the screen, you would type: 



4343: m 
129eG 

Experiment far a whUe. Room one is a good 
place for practice, but be carefiii. If you teleport 
to any location outside the room's wall 
boundaries and then walk off the screen you 
could end up,.. Oh, why should I tell you. 
You'U probably want to see tor yourself, won't 
you. lust don't blame me if you never get back, 
(By the way, you can get into the same rather 
unsettling situation by trying to put in a room 
value that's not on the map.) 

Well, back from the Twilight Zone. This 
leleporling is a pretty neat trick, and if it's not 
good for anything else, it certainly helps you 
keep out of sight of those big- mouthed desk 
clerks. 

Diagram 3: This final chart gives the 
memory locations of all seventy-two wall blocks 
on the screen. As described in Ray Darrah's 
article, the blocks actually overlap, but in the 
name of what little sanity 1 have left intact, I 
decided to depict the blocks as being adjacent. 

To the right of the chart, there is a list of all 
the useable values worth knowing. A "00" in 
any location blanks it out. A "01 ", on the other 
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hand, puis a wall on the left hand side of the 
block. There are a number of other values 
possible besides those listed, But using them 
results in the materializing of things such as 
"solid air", invisible, but tangible sections of 
nothing. Somewhere along the line I also 
remember discovering elevators that never 
failed to leave you in bizarre situations such as 
those described for diagram #2. (I also noticed 
Uiat even on die bottom level of the bunker, 
Uiese elevatois always went down. The phrase 
"Abandon all hope" immediately flashed 
across my mind.) 




One of the more useful purposes that I put 
my new chart to was that of imprisioning 
guards, or at the very least, blocking off those 
dratted alarm buttons so guards cannot reach 
them. Say you have just entered a room with 
one guard walking back and forth in front of 
the only other exit, located at the top of the 
screen. You wait in the shadows until he has 
walked, unsuspecting, into the upper left comer 



of the screen (Diagram 4). You hit the RESET 
button before the he knows what hit him, and 
are Qurown into tlie temporary safety of monitor. 
Looking at your screen block chart, you sec that 
the guard is occupying locations .$4000 and 
$4008. You put a S07 at S4O00 for the top of 
die box to trap him in and a $fflB for the bottom 
of the box at $4008, 

4000: 07 
40D8: m 
12980 

and the poor chap suddetUy finds himself quite 
trapped , while you are free to walk by 
unheeded. (Note: For all you sadists out there, 
The walls of die guard's new "prison' ' are one- 
way (see below). Although you can't shoot the 
guard, you can pull out your dagger and run 
him through right through the wall. Just don't 
walk into the block, or you too will be trapped.) 

As stated in the previous paragraph, due to 
the fact that the blocks overlap, all walls, except 
those at die edge of the screen, occupy portions 
of two adjacent blocks. A wall must be 
registered in both blocks for it to be completely 
solid. If you only register a wall in one block, 
it will only be solid from the side of the block 
you registered it on. Example: If, in an empty 
room, you wanted a wall between blocks J4013 
and $4814, and only typed: 

4013: 02 
12*«)G 
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The wall would only be solid if you ran into 
it from the left side of die screen. If you walke.d 
toward it from die right side, you would walk 
right through it. If, instead, you typed: 

4»13: »2 
4014; 01 
1209G 

you would look like a fool no matter what side 
you hit the wall from. 
Finally, I feel I should tell you that; 

A) If you kill Hitler, you can not just teleport 
back to room 1 to win the ganie. The computer 
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only registers a win if you go from room 2 to 
room i. Tlie "quickest way" is not always the 
best, Teleponing to room 2 and then walking 
down into room one on the other hand, does 
work. 

B) Mr, Darrah writes that pressing Reset and 
then typing: 

15AE: EA EA EA 

wUl give you an infinite number of bullets. 
Technically, this is not true. All this does is stop 
the camputer from subtracting bullets fixim your 
clip each time you fire, so you always liave the 
same number of bullets. For this to work, you 
must have at leasl one bullet in your clip. 

My compliments to Ray Darrah on a very 
informative as well a.i entertaining article on 
the dcprotcction of this game. Have fun. 
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Capturing the Hidden, 



Archon Editor 



by Steve and Rod Smith 



Archon 

Electronic Arts 
2755 Campus Dr. 
San Mateo. CA 94403 



Reqniremenbj: 

A Deprotected copy of Archon 

A sector editor 

A 48K slave disk with no HELLO 

Now that Steve McLendon has provided ail 
of you with a way wf deprotecting your 
Archons, we thought you might like to be in 
on a little secret program thai Jim Nitchals has 
left inside his code. Yes, that's right! A secret 
program! To view this incredible discovery, 
boot up your Archon, and when you arrive at 
the options page, type in control-I, J, L, N, then 
any key. You should now be sitting in the 
Archon editor. A brief summary of the things 
you can do will follow, after we explain how 
to get it out as a file. 

How We Discovered 
This Amazing Program 

Well, it wasn't too hard. After having 
deprotected the program, wc went snooping 
through the disk looking for strange text or 
leftover source code (a lot of programs are 
likely to have retnnauts or scrap data lying 



around). On track $11, sector $0F we noticed 
test that said "NOP THE NEXT 3 BYTES 
FOR GOODIES". It didn't take long to figure 
out that meant track Ifll, sector SBE, bytes 
fll-03 because of the wrap around. There we 
put EA EA EA and booted the disk. To our 
surprise was an editor! Then we put a 4C 59 
FF at the same spot and let it boot up. This 
allowed us to enter monitor and snoop around. 
That's where the secret key input sequence was 
discovered. So, our next concern was how to 
get the program into a single fde, since it 
supported DOS, and none is loaded with 
Archon. Leaving in our AC 59 FF at track $1 1 , 
sector $0E bytes $61-03. we set up for a boot 
by first clearing out memory with zeros by 
typing: 

FF59G 

3»1<3M.BFFEM 

6 BP] 

At the options page, press a button or 
something to start the game so that you will 
enter the monitor instead. Then we examine 
memory to see how much code was loaded. A 
quick look shows us that the program uses $803 
up to $3FFF. To get DOS in memory, we will 
need to reboot. So, we have to move the $800 
page up to $4ffl00 to save it from being 
clobbered during a boot by typing; 

Now we boot up a normal DOS disk with no 
HELLO program so we don't wipe out anything 
else in memory. Then wc move our $800 page 
back down to where it belongs by typing (make 
sure you're in the monitor): 

8e«<4«««.4«FFM 



Before we save the entire file out, we must 
make a few changes in the code . First of course 
is to remove our 4C 59 FF. It is residing at $901 
in memory and we need to replace it with EA 
EA EA. So wc type; 

M1:EA EA EA 

Now we would save the program out. 
However, hindsight tells us to make one more 
modification to the code. There are two parts 
to the Archon Editor. First is the shape editor 
and second is the hi-res page editor. We 
discovered a timing loop that will only allow 
you to remain in the hires editor for about ten 
minutes or so (very irritating!). So we wiU take 
out the counter by skipping over it before saving 
the fmal product. To do this we type; 

3299:4C A9 32 

Finally, we arc ready to save our fmal file! 
Just type: 

BSAVE EDITOR,A$8»3,L$38M 

and DOS will do the rest for you. Of course 
you may call the file anything you like. If you 
CATALOG your disk, you should see a 58 
sector binary file under the name you saved it 
as. 

Some Instructions 

Following, is a summary of the things we 
discovered you may do with the editor. I'herc 
are bugs in the DOS roufines still but most 
everything is usable. A word about the DOS 
bugs will follow. 

In addifion to the commands listed in tabic 
1 , the program also supports the joystick. Just 
move the little hand around and press the button 
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Table 1: 
Editor Commands 



step through DOS options 

(Relurr) or SB : 

Copy shape to spot indicated by * 



ight 



1 

4 

6,6 
7 
8 

a 




Select Plotting node 
Sound cl icl( toggle 
Fl Ip bits in row on/off 
Mirrors row 

Scroi I current row left or 
Change color set for row 
Change color set for byte 
Copy visible set to buffer 
Select shape set numbers 
Clears the editing area 
<> Increment/decrement width (1-4) 
Increment height of shape (2-24) 
(j-rro ws ) Hov e aste r isk 

Scrol I editing screen 
I .J,K,M Move plotting cursor 
(Space) Plot/unpiot pixel 

Z Mirror shape 

3 Vertical Mirror 

R Rotate shape 90 degrees 

¥ Delete a row 

e Insert a rpw 

G Delete a column 

H Insert a column 

I Undo mistake 

P Get shape from set (at *) 

& Erase the buffer 

N Animate sequence 

BD Quit and reboot 




E Edit hi-res page (and return) 

(=; *) Erase hl-res page 

W.A,S,Z Move hand 

I ,J|K,M Move edit window 

(Space) Plots/unplots/selects at hand 

= Another hl-res editing mode 

P capture highlighted block to shape 

(Return) Put shape at highlighted spot 




al the selection. Note: the program, like 
Archon, requires 64K. 

We have fotmd that the saving of hi- res 
pictures option does not work properly. If you 
do modify a picture, and wish to save il, the 
Editor has placed it in bank #1 of the RAM 
card. To get it, you should exit the program and 
go into the monitor. Write enable the language 
card. Copy the hS ROM to the language card, 
disable the ROM (select the RAM card) and 
save the picture, thusly: 

C»81 N C»81 
Vm%<¥9M.¥FFVM 
Ce83 N CB83 

Boot up DOS and save out your picture by 
typing: 

BSAVE PICTURE,A$2BM,L$1FFF 

or whatever you wish to call it. 

A Few Cumments 

This program is of high quality indeed, 11 is 
not known why Jim Nitchals chose to leave it 
in Archon as a secret program. However, alter 
Archon ][ came our, we were anxious to see 
if our "secret" was still there. Indeed, it was. 
But it is not a fully working version. Instead 
it gives a P.O. Box as to where you may contact 
Jim Nitchals for the source code. Our (the 
authors') letter went unanswered. 

With a little work, it should be simple to 
decode the shape files that get written to disk 
aiid use tlte shapes you create in your own 
programs. Have lots of fiin with tiiis apparent 
gift to hackers from Mr. Nitchafs. 

— -~ s 
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softkey for three frarn... 



Mindscape 



by Jeff Rivett 



Mindscape Inc. 
3444 Dundee Rd. 
Nonhhrook, IL mS62 



Requirements: 

The Halley Project, 

A View to a Kill 

The Mist 

48K Apple or compatible 

A blank disk 

Super lOB version 1.2 oi 1.5 



The Haitey Project 

The Hftlley IVoject: A Mifwion In our Solar 

System is a terrific new simulation -style gajne 
from Mindscape It provides a very accurate 
model of our solar system in which you perfonii 
various piloting tasks, gradually building up 
your rank. Obviously, some compromises have 
to be made in order to stuff an entire solar 
system onto one side of a floppy disk, bul those 
viihich have been chosen are completely 
acceptable, and don't detraa from the overall 
playability of the game. 

Untortunately, the disk is copy protected. 
These days, I try not to waste too much time 
with bit copiers, so after trying a few copiers 
on default and having no success, I went lo 
work. 

The first thing I foimd is that the Address and 
Data Epilogue bytes on this disk have been 
changed to FF FF, 1 immediately wrote a 
controller for lOB to get rid of thai obstacle. 
The copy booted up to the title page, where it 
appeared to do some kind of nibble -count. 

I own a Replay II copy card and 1 get a lot 
of use out of it wiien I'm trying to deprotect 
disks. One of the nice things about the card is 
that it shows you the current program counter 
when you hit the button. 

In this case, 1 waitetJ until I was sure the 
nibble-count was happening, then hit the Replay 
button and took note of the PC. I then got into 



the monitor and looked for suspicious code in 
tiiat area. Sure enough, I found a chunk of code 
that ended with a JuMP to C6O0, which of 
course boots the disk. A little farther back 1 
noticed a J MP to 1DO0. On a hunch, I decided 
to change the IMP to C6flO to a IMP to 1 D00. 
First 1 had to fmd that piece of code on the disk, 
so I used the Tracer from CIA to search for the 
string 4C00C6, and changed the code to 
4C001D. This time the disk booted perfectly. 
Here's a Super lOB controller to do die 
whole thing. Just install it into Super lOB as 
usual and RUN it. 

Halley Project controller 

1000 REM HALLEV PROJECT CONTROLLER 
1010TK = .LT = 35 :CO = WR :MB= 151 
1020 ST = :T1 =TK : GOSUB490 : RESTORE : GOSUB 

190 : GOSUB 210 ; GOSUB 170 
1030 GOSUB 430 ; GOSUB 100 : ST = ST + I ; I F ST < 

16 THEN 1030 
1040 IF BF THEN 1060 

1050 ST = :TK = TK + 1 : I F TK <: LT THEN 1030 
1060GOSUB310: GOSUB 230 :TK = T1 ;ST = 0:GOSUS 

490 
1070 GOSUB 430 ; GOSUB 100 : ST = ST + 1 ; 1 F ST < 

16 THEN 1070 
1080ST = 0;TK = TK+1: IFBF = 0WJDTK<LTTHEN 

1070 
1090 iFTK<LT THEN 1020 
1100 HOME ;AJ = "ALL'' DONE" : GOSUB 450 ; END 
5000 DATA213, 170, 150, 213. 170, 173 ,255 ,255 

,255 ,255 
5010 DATA V CHANGES 
5020 DATA 17 ,0 ,154 ,29 



controller checksums 



1000 - $366B 

1010 - $85C5 

1020 - SFC63 

1030 - iAD71 

1040 - J71B5 

1050 - SB973 

1060 - $71EF 



1070 - $2EF4 

1080 - i5DC3 

1090 - $1A37 

1100 - $0C37 

5000 - Vim 

5010 - $BF26 

5020 - S5EF6 



The Mist & A View to a Kill 

The Mbf and A View to a Kill are two new 

Adventure games from Mindscape. They both 



run under the Runtime Pascal system from 
Apple. This is easy to see from some of the 
characteristics of the boot, such as a screen fiill 
of inverse 'at' signs (@), and a weird solid 
block cursor that appears and disappears at the 
top left of your screen. 

Tlow convenient it is when a company uses 
basically the same protection on all their disks. 
These disks both use the same altered Address 
and Data Epilogue bytes as The Halley Project. 
The nibble-count or whatever it is works a litde 
differendy, though, because it happens right on 
track S. Again, 1 searched for the JMP to 
reboot, but replaced it this time with an RTS 
($60). 

Here's the controller for The Mist and A View 
to a Kill: 



Mist / View to a Kill controller 

1000 REM HIST fi VIEW TO KILL CONTROLLER 

1010TK = :LT = 35 ;CD = WR :MB = 151 

1020 ST = ;T1 =TK : GOSUB 490 ; RESTORE ; GOSUB 

190 ; GOSUe210 : GOSUB 170 
1030 GOSUB 430 ; GOSUB 100 : ST = ST + 1 ; 1 F ST < 

16 THEN 1030 
1040 IF BF THEN 1060 

1050 ST = :TK = TK+1 : IFTK < LT THEN 1030 
1060GOSUB310 : GOSUB 230 :TK = T1 :ST = : GOSUB 

490 
1070GOSUB430:fiOSUBI00:ST = ST+I : IFST< 

16 THEN 1070 
1030 ST = :TK = TK+1 : IFBF 

1070 
1090 IFTK<LTTHEN 1020 
1100 HOME :A( = "ALL' DONE" 
5000 DATA213. 170, 150, 213 

,255 ,255 
5010 DATA!'' CHANGES 
5020 DATA a ,12 ,144 ,96 



: AND TK<:LT THEN 



GOSUB 450 ; END 
170,173 ,255 ,255 



controller checksums 



- $356B 

1010 - $85C6 

1020 - $FC63 

1030 - SAD71 

1040 - S7166 

1050 - $B973 

1060 - J71EF 



1070 - $2BF4 

1080 - $50C3 

1090 - $1A37 

1100 - $0C37 

5000 - i94B0 

5010 - SBF26 

5020 - 15555 



i 
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Softkey for 

Alphabetic 

Keyboarding 



by Marc Lirette 



Souih-Weste.m Publishing Co. 
5101 Mudisun Rd. 
Cincinnati, OH 45227 

Requirements: 

Super lOB vl.5 

Two blank disks or 2 sides of one disk 

Alphabetic Ke> boarding k a 

typing program that leadies you tww 
to type. Like most other software on 
liie market, this prujjrain is proieeted. 
Although ihe program can he copied 
using EDD, an unprotected copy is 
always nice ro have. 

The Protection 

Upon receiving the program 1 
examined the protection scheme used, 
1 found that the DOS used was a fairly 
normal DOS although it was rather 
mixed up. By this 1 mean that the 
commands are moved aronnd, the 
buffers arc moved and its RWfS has 
been moved and mixed around 

I used "IKAX from Bag Of Tricks 
and examined the disk, fiy using the 
raw track dump I was able to sec that 
the third hyte of the data header was 
changed from the normal AD to 
another number. This number varies 
from track to track and from sector 
to sector. Also the disk has an extra 
byte after the header and this can 
create problems if it is not copied 



properly. The controller following 
this softkey will copy the disk for you 
properly. 

The Controller 

In line 1005 of I he controller the 
pokes will ignore reading errors, 
change the data header marker from 
AD to 96 and branch if it is not a 96 , 
This will cause RWTS to read the 
data field it it is not the address field. 
The poke in line 1020 will change the 
location of the translate buffer by one 
hyte so that it will ignore the extra 
byte. The poke in line ]<D3$ puts 

buffer location b.ick to normal before 

writing it back to the disk. 

There are three parts to the 
controller. The first part will copy 
tracks 3 to 16 ($03 to $10 hex) which 
is protected. The second will copy 
track 17 ($11 hex) which h normal 
DOS ^.3 format. The third pan will 
copy tracks 1 8 to 34 ($ 1 2 to $22 hex) 
which is also protected. The DOS Is 
not copied since it is proreclcd 
differently and you can put on your 
own fast DOS. 

Note: When copying the first disk 
you should hear the drive moan and 
groan when it copies track SIE 
sectors 5,6, and 7. This is because 
these three sectors are blank and the 
controller can't read them, 



Procedure 

11 Initialize your diskts) with a fast 
DOS. 

2) Install Ihe controller into Super 
lOB vl,5 and run it, 

3) Copy the Alphabetic Keyboard ing 
disk. Do not use the fonnal option. 

4) Knjoy your backup. 



controller 

1000 REM ALPHA CONTROLLER 

1005 POKE 4735S . 150 . POKE 47357 . 240 

: POKE 48712 .24 
1D10IK = 3;LT = 17:ST = 15:LS=15;CD 

WR : FAST 1 
1020 POKF 47349,87 (SOSUB 490 ■ GOSUB 

610 
1025 POKE 4734S ,86 : COSUB490 : GOSUB 
m-. IFPEEK(TRK)=LTTHEH1035 
1030 TK = PEEK (TT^K ) :ST = PEEK (SCT 

) : GOTO 1020 
1035TK = 17 LT= IS ST = 15 :LS = 15 
GOSUB 6t0 
GOSUB 610 
^36 ;Sf = 15 
.87: GOSUB 490: 



:LS=15 
: GOSUe 



1040 GOSUB 490 
1045 GOSUB 490 
105a TK= 18 ;LT 
1055 POKE 47349 

610 
1050 POKE 47349 .85 . GOSUB490 : GOSUB 

610: IFPEEK(TRK)=LTTHEN1@70 
1055 [K = PtbK (IRK) :S'I = PEbK (SCI 

) : GOTO 1055 
1070 HOME : PRINT "COPYDONE'' : END 



\ 
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Softltey for... 




by Jeff Rivett 



Activision 
P.O. Box 7Z87 
Mountain View, CA 



94039 



Requirements: 

48K Apple ][ or clone 

A blank disk 

A disk copy program 

It was sui-prlsiiig to find that this disk is 
protected. I thought that Acti vision would figure 
that it was a waste of time to protect a program 
aimed at hackers. Wrong. 

The first thing I usually do when I get a new 
program is to check which tracks, if any, are 
formatted in some non-standard way. The 
easiest way to do this is to try and read it with 
Locksmith's fast disk backup, HACKER read 
perfectly, so I immediately made a copy of the 
disk. 

On booting the copy, I found it worked ok, 
except that I noticed the drive fecalibrated 
(returned to track zero) and stayed there for a 
while at one point during the hoot. This made 
me a little suspicious, so I decided to get into 
the game a little just to make sure nothing went 
screwy . Sure enough, after I had progressed 
past the first few stages of the game, it hung 
up completely. 

I rebooted the disk to check on that 
recalibration at this point. This time I also 
noticed the Applesoft prompt at the bottom of 
the screen during the boot, and thai it 
disappeared just after the recalibralion. The 
protnpt isn't as promising a sight as it used to 
be when trying to deprotect disks, but it 
sometimes gives you an indication of a 'near 
DOS 3.3' type of DOS. 

For a laugh, I tried booting the disk again, 
but this time I hit J&ICi as soon as I turned the 
power on. This would normally cau.se an 
Applesoft boot program to break. Surprise, 
surprise! It worked. The boot program was 
there, and listable. I tried CATALOG, whieh 
also worked. 

The boot program BLOADs a large binary 
file, then BRUNs a smaller file, called 
HACKB, To coirfirm a hunch, 1 typed 
MONICO to turn on the DOS monitor, and then 
RUN. The first file loaded, Uien tl)e HACKB 
Started to run. Almost immediately, the drive 
recalibrated. 

At this point I printed out a Disassembled 
listing of HACKB. It loads at $5 EM, and its 
length is $1E1. This chuak of code does a lot 



of weird stuff, but all I was interested in was 
disk access. Disk access code looks like LDA 
$C889,X which turns on the drive motor. 
Aitnost anything that accesses memory in the 
range $C080,X to $CB8F,X is a command to 
the drive controller card. Other code to look 
for is any call to die RWTS, which is SB7B5 
in normal DOS. 

I found two subroutines in HACKB which 
mess widi the disk. One is at $5E5D - $5E6C, 
and tlie other at $5E6D - $5EC2. The first 
routine just sets up for and calls the RWTS to 
send tlie drive head back to track zero, which 
is the recalibration I noticed. The other one is 
a little more complicated, but all it really does 
is look for some special bytes on track zero. 

Whai I then looked for was any code in the 
second routine which alters memory , like a STA 
or a STX, which store stuff in memory. 1 found 
two pieces of code like this, at 1!5EA3, which 
stores the Y register in $FC, and at S5EB4, 
which stores the Accumulator in $5E18. 

The code in this routine is fairly hnear, in 
that it doesn't do any jumping out of itself, and 
the looping it does is usually back a few steps 
only. The trick here is to find out what $FC 
and $5E18 are supposed to have in them after 
the routine checks track zero. So I put a IMP 
to $FF59 at $5EB7, so that after the track zero 
check, and after the two special locations are 
set, we jump to die monitor, I then ran the 
program, and when the monitor prompt 
appe^ired, I checked $FC and $5E18 to see what 
they came up with. They were, respectively, 
$FF and $55. 

Now all I did was replace the code that 
checked track zero with a couple of lines of code 
to set the two locations, and saved HACKB. 
The changes are listed below. The new version 
did not hang, I have been all the way through 
the program, and it worked just fine. 

The changes made to HACKB: 



5E76- 


A9 FF 


LDA 


#SFF 


5E7S- 


85 


FC 


STA 


IFC 


6E7A- 


A9 


55 


LDA 


#J55 


5E7C" 


4C 


B4 


5E JHP 

Step by step 


$5ES4 



1) Make a copy of the disk with COPYA or a 
similar copier. 

2) Boot the copy and hit IBCI quickly to break 
out of HELLO. 

3) Fix HACKB to work on the copy. 

HLOAD HACKB 

CALL -151 

5E76:A$ FF 85 FC A9 55 4C B4 5E 

BSAVE HACKB,A$5E»e,LSlEl 

That's it! Hack away. 

i 
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softkey for... 



Disk Director 



by A. L. Head, Jr. 



Sensible Sofin'are 

24011 SentOi 

Oak Park, MI 48237 



Requirements: 

4BK Apple ][ and up 

FID from the DOS 3,3 System Master 

Disk Director 

Two blank disks 

Super lOB vl.5 (Optional) 

Disk Director, produced by Setts ible 
Software and licensed to Softsmith for 
distribution, is a great disk utility for 
unprotected disks. There are tliree major 
programs on the disk as follows: Disk 
Organizer, Disk Recovery and Super Disk 
Copy, The Disk Organizer permits one to 
alphabetLce die files on a disk, change the 
HELLO program, delete and undelete files, add 
titles within the catalog, lock and unlock files, 
Zap DOS, show the track/sector map, et cetera. 
The Disk Recovery checks for bad sectors, 
locks them out, rebuilds the VTOC, lisis the 
files with bad sectors, et cetera. Super Disk 
Copy features a Quick Copy that only copies 
sectors that are used; a Contiguous Copy that 
re -arranges the track/sector usage of the files 
in a continuous manner; and a Brute Force 
Copy that copies a disk sector by sector, DOS 
or die entire disk can be copied. Control 
characters are highlighted in the catalog. A very 
useful feature is the track/ sec tor map. 

The Protection 

On to the examination of die disk. This disk 
has a modified DOS on it. Tracks $80 through 
$02 use address and data epilogues of $FF FF 
instead of the standard $DE AA. In addition, 
the address field checksums are set to various 
values. Tracks 5B1 through $22 are in standard 
DOS 3,3 foniiat except dial the address fields 
checksums are non-zero. Tracks $03 through 
$10 are empty. A softkey can be determined 
with the above information. 

The Softkeys 

This disk is easily deprotected. The modified 
DOS will be circumvented by installing normal 



DOS on the copy . 1 will give you two different 
ways of doing it here. The first way will use 
the FID program on the System Master, If you 
have Super lOB 1 .5, the second way is easier. 
I have written a controller to normalize the disk. 
1 will start widi the FID method. 

1) Boot the DOS 3.3 Master disk. 

2) Insert a blank disk and initialize it witli no 
HELLO program: 

FP 

INIT HELLO 

DELETE HELLO 

3) Apply a patch to DOS in memory to ignore 
address checksums: 

CALL -151 

m»^■M 

4) Get FID nmning and copy die Disk Director. 

BRUN no 

When the FID display appears, use the 
wildcard (=) to copy every fde to the duplicate 
disk. Do not seJect "Prompting*. 

5) Wlien the copying is complete, boot the copy. 
When the BASIC prompt appears (probably 
with a FILE NOT FOUND), type NEW and 
then type in the program given below. Alter the 
filename to match the original HELLO program 
on the disk if necessary. Note that die filename 
is the full thirty characters allowed by DOS. 

10PRINTCHMM) "BRUrHELLO""^^^^^*^^ 

And save the program, of course, 
SAVE HELLO 

We're pretty much done at this point. If you 
wish, you may pack the files on the disk closer 
togedier by copying everything to another blank 
di.sk using the Contiguous Copy option on the 
Disk Director. Then you may re-use the first 
backup for something else. 

You now have a completely normalized copy 
of Disk Director, 

The Super lOB Method 

1) Initialize a blank disk the same way as in 
steps 1 and 2 above. 

2) Install the Controller with diis article into 
Super lOB 1 .5 and start Super TOB. 

3) Copy the Disk Director disk onto your newly 
initialized disk. Do not use Super lOB's Format 
option. 

The controller given at the end of this article 
begins copying the original at track $11. AH 



files are contained on the original disk between 
tracks $1 1 and $22. 

4) Now all you need to do is add the HRLLO 
program to the disk as in step 5 of Ifie FED 
method . 

Et Cetera... 

The copy of Disk Director produced here 
retains all the features of the original except the 
Softsmith logo which is contained in one of the 
boot stages. A more enterprising person might 
search for it. I will leave that to others. 

Many other software products use a variation 
of the protection used on this disk; that is, a 
modified DOS with the files written to disk in 
more or less standard form. When this is the 
case, standard DOS can be written to the copy 
by initializing the disk as done above. The 
altered marks and/or checksums can be taken 
care of by patching DOS and then using FID 
or a similar program to transfer the files from 
the original to the copy. Then a HELLO 
program can be written to run the program or 
whatever as done here. Using Super lOB 1,5 
provides an easier way to accomplish the same 
end . In virmally all such cases the use of a fast 
DOS (I use Pronto- DOS with the enhancement 
to print the number of free sectors in the 
CATALOG) instead of DOS 3.3 on the copy 
disk will speed up the ranning and loading of 
fdes by a factor of about three. Disk Director 
provides an option to copy just the DOS portion 
of a disk to another disk. I have never 
encountered any difficulty by doing this. A disk 
done this way is much faster than the original. 

Any of the popular bit -copy programs will 
copy DISK DIRECTOR witli tlieir default 
settings and produce a protected copy. I have 
used COPY ]t PLUS and E.D.D. HI. 

controller 

1000 REM DISK DIRECTOR CONTROLLER 

1010TK = 17 :LT = 35 'ST = 15 :LS=15 :CD = m 

: FAST = 1 
ie20GOSUB«0 : GOSUB270 ; GOSUB 610 
1030 GOSUB 490 : GOSUE 610 : IF PEEI^ (TRK ) = LT 

THEN 1050 
1040 TK = PEEK (TRK) :ST = PEEK (SCT) :GOTO1020 
1050HOIlflE . PRINT "DONE" WITH" COPY" : END 



coDtroUer checksums 



1000 - S355B 
1010 - S1CD4 
1020 - $9284 



1030 - I26E0 
1040 - JA94E 
1050 - J4914 
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Revisiting 



m\j)\i 



by Steve Marvin 



/»(A? Runner 
Broderbiind Softvt'are 
1938 FoM-th Street 
San Rafael, CA 949&! 



Requirements! 

At least 48K 

DOS 3.3 or equivalent 

Super lOB vl.5 

Lode Runner 

A blank disk. 

Tom Piiclps' softkcy for Lode Runner by 
Broderbund Software (Hardcore COMPUTIST 
No. 22), creates a 1 14 sector program file and 
requires a method to reset into the monitor. It 
also writes code over the visible text page on 
boot and preserves Lode Runner's reset vectors, 
which force a reboot on Reset from the game. 

Although I have a modified CD ROM 
(Synergistics) in my //c which allows a cold 
boot to the monitor, with Lode Runner I ended 
up with a memory full of zeros. Lode Runner 
copies the monitor to the language card and 
alters the reset pointer bytes $FFFC-FKFD to 
S2O0, a subroutine which wipes RAM and 
re- boots. 

For these reasons I had to do some extra 
work for my backup copy and will share this 
witli otliers in tlie same predicament. If you 
were successful with Mr. Phelps' meihod but 



wish to trim the program, just enter the 
LR, MOVES iiexdump and proceed to step 6. 

My Method 

The infamous boot code trace, a six step 
process involving monitor code moves, 
studying dumps and stack tracing led to a binary 
file I,R. LOADER, the creation of which is 
discussed later in the article. To quickly sum 
it up, Bootl (the first sector on track 0) decodes 
two subroutmes and four addresses (by 
Exclusive-ORing with $A5) and puts them in 
the zero page and the stack. It llien perfonns 
some jumps hy pretending that the addresses 
in the stack were left there by JSRs and 
"remrning'' to them with RTSs. 

The subroutines it performs are as follows; 

$00B4: sets up he-ider bytes of $D4 D5 D6 
and a trailer byte of $D7. 

$0060: finds and reads 4 sectors with the 
above header and trailer (No address field, the 
data is 4+4 encoded, with no address field) into 
S400 through $7FF. 

S400: No action, just an RTS (W0). 

$401 : Changes the header bytes to $DD %¥5 
$D4, with a trailer of $D4, and steps by phases 
past track S0D, Then it reads one 4+4 encoded 
sector over the code at $498, turns the drive 
off, and jumps to $400. 

The new code at $400, together with the 
previous boot code in $500-$7FF, moves 
inward continually by specific numbers of 
phases and reads all the remaining code that Mr, 
Phelps found after his reset. This includes a 
normal DOS 3,3 RWl'S in SB600-$BFFF 
(except for an altered JuMP in the INIT 
handler). Then a short reset handler is placed 
in S200 (the input buffer) and all reset pointers 
are changed to point to it. The RAM card 



copying (and altcrmg) is also done at this time. 

By investigation, comparison and 
experimentation I found that (a) a Normal 
R'WTS can be used, (b) the code frotii 
S40fl-$8FF is never reused after booting, (c) 
the code and vectors in pages two and three can 
be altered without damage, (d) a short series 
of pokes takes care of page 0, (e) the stack is 
reinitialized each reset, (f) there is no code or 
data loaded at $IF00-$1FFF. and (g) 
$8F00-$8FFF is zeroed on boot. 

Using this information I produced a 93 sector 
BRUN pr^ram which does not display garbage 
while bootiiig, and will reset to the beginning 
of the game rather than re-boot (A nice feature, 
I diink). 

The Procedure 

1) INIT a DOS Slave disk with a binary Hello 
program called LODE RUNNER, 

NEW 

CALL-lSl 

9E42:34 

3D3G 

INIT LODE RUNNER 

DELETE LODE RUNNER 

Note: You may use any DOS with a normal 
RWTS as long as SBE0E holds the IN IT 
handler's address and the INIT handler lives at 
$BEAF, 

2) Install tlie lOB controller at the end of this 
article and run Super lOB to capmre tracks 3 
through $C onto your newly initialized disk, 
(This controller uses Super lOB vl.5"s R/W a 
Range Quickly routine and pertbrms sector edits 
to correct the VTOC for track 3$C usage). 

3) Build the binary file LR. MOVES (Mr, 



2t 
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LS^yKii^gLS 



Phelp's subroutines with reset and setup code 
added). 



CALL -151 



1F00 

IFBB 

iFie 

IFIS 
1F20 
1F28 
1F30 
1F38 
1F40 
1F48 

1F50 
1F53 
1F60 
1F68 
1F70 
1F78 
1F80 



m 4F 

LF A0 
60 IF 
F3 A0 
60 IF 
20 60 
SC CC 
A5 2B 
7B IF 
A9 02 



A9 9B A2 IC 20 
20 A9 60 A2 2F 
A9 40 85 E5 20 
40 A9 09 A2 06 
A0 40 fl9 3F A2 
IF A0 00 3C 0E 
BE A9 8E 8D 0F 
8E FF 02 A0 48 
99 00 02 
A0 00 SC F2 



10 

03 



50 
20 
F2 
20 
0C 
BE 
BE 
B9 
F7 
6D 



n 

49 
34 
86 
C8 

D0 
2C 

1F8S: 2F 
1F90; 63 
1F98: A9 



03 8C 
A5 8D 

01 85 

02 A0 
M F9 
F0 60 
A9 CC 
FB 20 
W 00 
FF 85 



F0 03 
F4 03 

03 A9 
00 Bl 
E6 01 
A9 D2 
2C A9 
58 FC 

04 A9 
99 A9 



80 Fl 03 
4C 19 02 
00 85 00 
00 91 02 
E6 03 CA 
2C A9 D0 
Al 48 20 
20 84 FE 
06 85 8C 
CA 85 95 



45DA8 
$4EEF 
$61 AC 
JFE47 
$8762 
$0F5e 
S7296 
SC4C8 
S3CBE 
$C496 

$9B21 
$FFB0 

$8FFE 
$C)5EB 
S24CD 
S3A4E 
S8AD5 
$46FC 
S67FB 
556C9 



1FA0: A9 4C 85 23 A9 50 85 35 i07Al 

1FA8: A9 3E 85 37 A9 B5 85 38 $49CS 

1FB0: A9 B7 85 39 4C 00 60 $A84F 

3D3(; 

BSAVE LR.MOVES,A$IFflfi,L$0B7 

4) Create the file LR. LOADER as follows: 

MAXFILES 1 
CALL -151 
96(»<C6M.CdFFM 

95S4: 4C 30 95 A9 I0C13 

9568- 00 8D 96 01 A9 04 80 07 SFC28 

9570; 01 A9 83 8D 75 04 A9 95 S7E72 

9578. 8D 76 04 A9 09 8D 5E 04 SA1D5 



9580 
9588 
9590 
9598 
95A0 
95A3 

9be0 

95B8 
95C0 
95C8 
95D0 
95D8 
95E0 
95E8 
95 F0 
95F8 



4C 01 04 A0 00 B9 00 09 $0819 

99 00 04 88 D0 F7 A9 96 $A6F9 

8D 71 04 A9 95 8D 72 04 $0893 

4C 00 04 90 83 C0 A2 09 S2DDF 

A0 00 B9 00 00 99 00 20 S962C 

88 D0 F7 EE A4 95 EE A7 $3611 



96 CA 

55 8D 
01 A0 
08 88 
59 96 
00 09 
45 03 
95 8D 
99 16 
80 F9 



D0 EC 4C 59 FF 
06 01 A9 95 80 
47 B9 00 09 99 
D0 F7 60 A9 ID 
A0 00 B9 00 08 
88 D0 F7 A9 4C 
A9 B7 3D 46 08 
47 08 A9 EA A0 
08 88 D0 FA A9 
96 A9 08 3D FA 



$6B7E 
$2DBF 
I3A56 
8D $0990 
99 $0C7B 
8D SA0FC 
A9 IC45D 
$39DE 
01 18EE8 
96 $E1D0 



96F8:4C CD 95 

BSAVE LR.LOADER,A$9564,L$197 

5) Insert your original Lode Runner disk in the 
drive and type 

9564G 

The drive will recalibrate twice, the screen 
will fill with garbage, and you wih hear the 
lengthy Lode Runner hoot ending with a bell 
and the monitor prompt. The drive will turn off 
at this point. (A disassembly of the loader will 
reveal what happened.) 

6) Compact the code and insert the entry jump: 
2m»<6«im.SEFFM, 

4Fm<9nm.TiSFFwi 

eEFD:4C m IF 

7) Boot your DOS Slave with LR. MOVES on 
it: 

6 IRP1 

BLOAD LR.MOVES,A$lF»« 



Change to your new Lode Runner Disk, 

BSAVE LODE 
RUNNER,A$flEFD,L$5B«3 

That's It !i 



controller 

1000 REM LODERUNNER SCREEN CONTROLLER 
1010TK=3:LT = 13 :ST=15:LS = 15 :CD = WR:FAST 

= 1 
1020 Tl =TK ; GOSUB 490 . RESTORE : GOSUB 170 : 

GOSUe270 : GOSUB 510 
1030 GOSUB 230 : GOSUB 490 . GOSUB 610 IF 

PEEK(TRK ) = LT THEN 1050 
1040TK = PEEH(TRK) :ST = PEEK (SCT) ; GOTO 1020 
1050CD = RD ■TK = 17 :LT = 17 ;ST = 15 :LS = 15 
1060 GOSUB 500 -GOSUB 510 
1070 AS = "3544:00' N' 3645<;3644.3669H'' N" 

2703:00" N' 2704<2703,27FEM' N' D9C5G" 
1080 FOR A = 1 TO LEN (A$ ) : POKE Silt A , ASC ( 

MID$ (A$ ,A .1 ) ) + 128 : NEH ; POKE 72 ,0 

. CALL - 144 
1090 GOSUB 490 : GOSUB 610 
110eHOME:A$ = "DONE"WITH''COPV" .GOSUB 450: 

END 
5000DATA222 ,235 ^222 ,170 

controller check$tums 



1060 - $5046 

1070 - S953A 

1080 - S2E90 

1090 - $7195 

1100 - $A963 

5000 - 58990 



- S355B 

1010 - $1336 

1020 - $4C8D 

1030 - $7914 

1040 - $36F5 

1050 - $9568 
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softkey for... 



MIDI/4 
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by Ray Darrah 



M!DI/4 

Passport Designs Inc 

785 Main Si. 

Half Moon Bay, CA 94019 



Requirements 

48K Apple ][ Plus or greater 
MIDI interface 

It really upsets my stomach when a company 
protects 2 piece of software that requires 
hardware to run. Such is the case with MIDI/4, 
a decent multi-track recording package. I am 
still trying to figure out why they proteeied this 
software sinee it requires a MIDI interface 
before it will operate. Is Passport Design afraid 
users will pirate their hardware as well as their 
software? 

As usual, my strong dislike for protected 
programs (especially tliose of a utility nature) 
coupled with Passport's audacity has compelled 
me to deproiect llie little sucker. In addition, 
T find that after I deprotect a program, T sleep 
better at night. 

An Overview 

At first, I tried copying the disk with my 
favorite whole disk copier: Locksmith Fast 
Copy. This showed me that the disk wa.s normal 
DOS except for tracks $03 and $10. Of course, 
the copied disk would not boot. 

I then examined tracks $03 and $10 to 
discover that these tracks were of a nibble count 
nature rather than an altered DOS nature. As 
a matter of fact, listening to the boot I could 
tell that the nibble count was most probably 
occurring right after the title page was loaded 



in. The next step was then to locate the nasty 
nibble count routine and defeat it. 

Using my trusty ABACUS Know-Drive, I 
interrupted the program during the dirty nibble 
count and discovered that it lived somewhere 
above S8D00 and below $95P9. Watciiing the 
disk head during the boot told me that it only 
nibble counted track $10, But if that one failed, 
the head would move to track $03. Perhaps 
track $03 is an exact copy of track $10 (sort 
of a hackijpcopy of the nibble counted track). 

Searching the disk for the nibble count code 
revealed that it was contained in a file called 
READER. I spent a few hours tracing the code 
in the READER file and decided that this was 
not the way . I congratulate whoever wrote this 
code for creating another Frankenstein. 

1 then .scrutinized the boot file .sequence by 
putting a few MONCIO's here and there and 
discovered that the first part of it went like this: 
First, the Diveisi-DOS on the disk loads and 
execuies HELLO which executes DDM, loads 
the title picture (PD1M4P1) and executes 
M4XX. The binary file M4XX then load.s 
READER and executes it via the JMP $8D00 
at $958. If everything goes O.K. in the 
READER file (nibble counts etc.), BRUNM4P 
is executed and the program magically comes 
to life! 

With this knowledge in hand (or mind), I 
decided to re-route the hoot sequence to 
eliminate execution of that bugger known as the 
READER file. My new boot sequence then 
would be like this: First, the Divcrsi-DOS on 
the disk loads and executes HELLO which 
executes DDM, loads the title picture 
(PDIM4P1 ), load.s BRUNM4P and executes a 
modified M4XX. The modified M4XX file dien 
loads READER and executes BRUNM4P via 
the modification. 

This modifed boot sequence almost worked 
except it kept bombing into the monitor at 
$A04. 1 noticed at this point a $A0AG would 
start up the program. So I searched the 
BRUNM4P file for a JMP to somewhere in 



$A00. I changed the JMP $A01 at location 
58069 to a JMP ,SA0A and, volla! MIDI/4 was 
now broken! 
Exact details of the deprotection now follow. 

Step by Step 

1) Copy your original MIDI/4 disk with some 
whole disk copier that can ignore errors on 
tracks Mi and SIR (like Locksmith Fast Copy). 

2) Put your original MIDI/4 disk away and 
LOAD HELLO from the copy. 

3) Change line 6 of HELLO to read; 

SPRINT CHRJ (4) "BLOAD" BRUNM4P" : PRINT CHRS 
(4 ) "BRUNHIXX" 

4) Rcsave HELLO to the copy. 

UNLOCK HELLO 
SAVE HELLO 
LOCK HELLO 

5) Modify the M4XX program to execute 
BRUNM4P instead of READER. 

FP 

BLOAD M4XX 

CALL -151 

958:40 m 89 

UNLOCK M4XX 

BSAVE M4XX,A2»49,L346 

LOCK M4XX 

5) Modify the BRUNM4P program to JuMP 
to $A0A instead of $A01. 

BLOAD BRUNM4P 

8«69:4C «A «A 

UNLOCK BRUNM4P 

BSAVE nRliNM4P,A32768,Lfi3« 

LOCK BRUNM4P 

That's it! Enjoy. 

Many ifianks to Raymond Feruski. 
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We are NOT 

PIRATES! 

but m^e're not fools, either. 

We're serious programmers and software 
users who just want to have backup copies 
of any software we own. COMPUTIST 
magazine shows us HOW TO MAKE 
BACKUPS OF COMMERCIAL SOFTWARE 
regardless of the maker's attempt to stop us 
from having legal copies. Don't let them stop 
you from protecting your own rights. 



Remove copy-protection 

from your valuable library of expensive software. The 
publisher of COMPUTIST has been showing subscribers 
how to unlock and modify commercial software for the past 
4 years. Don't be one of the users abused by user- 
FIENDLY locked-up software. Subscribe. 



6 issuQ SUBSCRIPTION RATES: 
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Canada, Mexico: S34 
Foreign Air: $60 
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With every set of 20 disks you order 
You can get sets for as low as 

$17.25 

That's a total of 

25 disks 
for OS little as 

694; 

a disk 



SS/DD Namebrand 

5V4" floppies 
100% guaranteed 

& include: 

reinforced hubs 

& write-protect tabs 
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A nibble of history... 

Creative Computing 
bytes tiie dust 

In memory of the demise of Craitivc Compuiing. our oid adversary 
(oiiu uf nianj). wt prcstnl u nibbU' of history from tht heydays 
of Hardcore Computing... 
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Creative Computing Censors Hardcore Advertisenient 



t'rcativc Computing is still censoring 
ads and suppressing information abont 
copy protect ion. 1 1 has just refused to 
publish the HARDCORE advertisement 
shown on this page, 

\\'h»\ dill the editors of CC find 
unprintable in our ad? 

''Only two lines," explained their 
Advertising Manager, Jerry Tiiompson. 
'■They are: 'hack up any diskette' and 'do 
& undo copy-protcetion'." 

Jeri7 said that eitlier we agree to let tliem 
remove those lines or they would refuse 
lo run the ad Well, we stood by our 
editorial policy of fighting censorship and 
they stood by their policy of information 
suppression. So you won't sec this ad in 
CC. 

One of their editors, George Blank, 
defended CC's policy by offering the lame 
comparison tt) Reader's Digest's polley 
against running liquor ads. He added that 
at least CC will run ads for competitors. 

Big Deal: All of them share CC's 
censorship policy. All of them, except 
Hardcore Computing, And they will not 
run our aUs. 

George's final defense was that CC had 
a readership of well over 100,000... so 
obviously they must be doing I Kings right. 
What can 1 say to that? 

And when 1 mentioned that the readers 
have had no alternative, he answered 
prompdy. "Yes, they do!" (meaning his 
competitors). 1 retorted thai they praetiee 
the same form of censorship. 

"That might mean that we're right and 
you're wrong." he concluded. 



So. ..The battle goes on. 



lutnoibc to... 



HARDCO 




CC is probably just the first computer 
magazine to censor HARDCORE'S ads. 
We plan to tiy to put one In Call 
A.P.F.Lh. , but unless Val Goiding, the 
editor, has altered liis policy, they will 
probably refuse to run our ad. too. 

'We'll keep you posted on ftirther 
developments. 



Addendum; Call- A.f.F.Lh. didn't 
run our ad, but we learned from Orawin 
Publications that it wasn't Val Goiding 
who had our ad pulled from its pages at 
the last moment. It was the doing of Dick 
Hubert , President of Cull A. P. P. L. E. , and 
its Executive Dircetor. 



George Blank \\ reply...... 

Dear editor. 

You quoted tne correctly and for that 1 
«»! grateful. I do not fed that you quoted 
me in i.-vnte.r.t. For exampk\ m\ "lame 
excuse ' ' that Reader.'! '.<: Dige.<:t refii.\fd 
liquor ads came ul a point in our 
conversation when we were dl.scu.'i.'^ing the 
faa that the court s have allowed publishers 
the right to set their own standards for 
uciepting advertising. 

I invite you to practice what you preach. 
IJ software price.'! are ^o extortionate, how 
do you justify $20 a year for your few 
miserable pages of hurd-to-reud 
mimeographed text? For the same price, 
your readers could buy over 2500 pages 
of Apple material printed in Creative 
Computing, or even over 400 pages of 
Apple material if you watu to throw tivia)' 

all our ads. gefieral arlirle^. and material 
on Other computers' 

Uie truth /.s mo.'it current soft\^'are 
companies are not profitable. We know; 
we keep getting bartkruptvy notices instead 
of payment for advertisemeitts, even from 
e.stahhshed firms. Ami d is casttal copying, 
itot professional pirates, that hurts profits 
mo^t. In my owfi case, ! no longer write 
programs for publication: it is more 
profitable lu write custom software. 

Sincerely your,'^, 

George Blank. 

Editor, Creative Com.puting 



Tfie text above was reprinted from an editorial in Hardcore Update 1.1 , September 1981 which followed the printing of the Premier Issue. 

The Best Of Hardcore Computing 

Discover Hi.storv! Get your own eopy of the Rest Of Hardcore Computing by sending in $19,95 check or money order 
(US funds only) to: COMPUTIST; ?0 Box I 10846 -T, Taccma, WA 9841 I. Washington state urderv add 7.8% sales lax. 
Foreign orders add ^0% shipping and handling, VISA and MC orders enclose signature and expiration date, 
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Back Issues 



of COMPUTIST (formerly Hardcore Computist) 

are still available. 

Some Issues (mari(ecl NAj are sold out, 

but library disks are available for all issues of COMPUTIST 

and even the old COREs. 



Don't 



in programs that appear in COMPUTIST. 

Order the Library Disk, instead! 

Each month a Library Disk with all the programs that appeared in the previous issue of COMPUTIST 
is prepared for SMART READERS iike you who have better things to do with their time than type in 
program listings. Please use the order form to order both magazines and library disks, 



Back Issues and Library Disk order toriin 



Issue 



Majjazine Disk 
$4.75 $9,95 



Issue 



Magazine Disk 
S4.75 S9.95 



Issue Magazine Pisk 

$4,75 ^9.95 

10 NA . . . a 

9 NA . . . □ 

8 NA . . . □ 

7 n ... . n 

6 NA . . . D 

5 NA . . . D 

4. U U 

3 NA . . . D 

2 NA . . . n 



Issue 



Ma^azint; Disk 
$4.75 S9.9.5 



28 n 

27 □ 

26 U 

25 D 

24 D 

23 ..... n 

22 D 

21 D 

20 ..... U 



D 

n 
u 

D 

n 
n 

D 

a 
□ 



19 D . 

18. D . 

17 D . 

16. ....n . 

15 NA 

14. . . . .NA 

13 D . 

12 NA 

11. . ...NA 



D 

n 
a 

n 
□ 
n 
n 
u 
n 



Core 3 
Core 2 
Core 1 



D 

D 
D 
D 



D 

D 
D 
□ 



Send me the back issues and/or library disks indicated above: 

Name . __ID#- 
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Cminlry 
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. Phone . 



Exp 



_CP28 



Send chock or money order lo: 

COMPUTIST 

PO Box n0846-T 

Tacoma, WA 98411 

Most orders shipped UPS. 

Please use street address. 

//J W^ishin^fou state: 

itdd 7.8% sidi's lux 

Pareigfj itrderx: 

add 20% .^hipiJirtii urid fuiriddn^. 

LIS Tunds drawn on US bank. 

Offer ^ood wliile .«iupp]y L^sls. 



Description of Available Back Issues 



^S £ Softkeyi | Microzines 1-5 | 
Microzineii 7-P | Microzines (ahemate method) | 
Phi Beta Filer | Sword of Kadash | Features \ 
Daleks: Exploring Artificial Intelligence | Making 
32K or 16K. Slave Disks | O/re ' The Games of 
1^85: partll | Reader's Sofikeys \ Miner 2049er | 
learning with Fuzzy womp | Bookends | Apple 
LOGO 11 I Murder on the Zindcrneuf 



Sofikev! I Cannonball Blitz |. Instant 
Recall Gesslcr Spanish software | More 
Stickybears | Reuden ' Softkeyi \ Financial 
Cookhook I Super Zaxxon | Wizardry | 
Preschool Fun | Holy Grail | Inca | 128K 
Zaxxon I Features \ ProEdit | Core \ Games of 
1985 part I \ .._........„........,......„_._...„.. 



Sofik<^ys ■ Dfl Master4.2 | Business 
Writer I Barron's Computer SAT I Take 1 Bank 
Street Speller | Where In The World Is Carmen 
Sandiego | Bank Street Writer 128K | Word 
Challenge | Readers ' Softkeys \ Spy's Demise I 
Mind Prober I BC's truest For Tires | Early 
Games Homeword Speller | Feasures \ Adding 
IF THEN ELSE To Applesoft | Core \ DOS To 
ProDOS And Back ' 



Softkeys \ Electronic Arts software | 
Grolier software | Xyphus | F-15 Strike Eagle | 
IriJLired Engine ' Reuden' Svfikeys \ Mr. Robot 
And His Robot Factory I AppleciUin II | Alphabet 
Zoo I Fathoms 40 | Story Maker | Early Games 
Matchmaker | Robots Of Dawn | Features \ 
Essential Data Dtiphtator copy pai'ms | Cure \ 
Direct Sector Access From DOS 



Softkeyi i Clioplifier | MufploL 
Flashcalc | Karateka | Newsroom | G-Z Draw 
Rciiden' Softkeyi I Guto ; Dlno Eggs | Pinball 
Construction Set | TAf! | The Print Shop: 
Graphic;; Library | Death In The Caribbean | 
Features \ Using A.R.D. To Softkey Mars Cars | 
How To Be The Writemaster | Core \ Wheel Of 
Monev I 



Softkeys Miner 2049er | Lode 
Runner | A2-PB1 Pinhall | Readers' Softkeys \ 
The Heist | Old Ironsides I Grandma's House | 
In Search of the Most Amazing Thing | Morioc's 
Tower I Marauder | Sargon III Features i 
Customized Drive Speed Control | Super JOB 
version 1.5 | Core < The Macro System | 

^S 1 Sopkeys \ DB Master version 4+ | 
Dazzle Draw Archon | Twerps | Readers' 
Softkeys I Advanced Blackjack | Megaworks | 
Sunnner Games | College Entrance Exam Prep | 
.Applewriter revisited | Features \ Demystifying 



The Quaner Track | Core 
ProDOS Disk Monitor 



Proshadow; A 



Softkeys \ Sargon III | Wizardry: 
Proving Grounds of the Mad Overlord and Kinghl 
of Diamonds | Reader' Softkeys \ The Repnri 
Card Vl.l | Kidwriter I Feaiurc \ Apple ][ Bool 
ROM Disassembly | core ' The Graphic Grabber 
v3.0 ! Copy 11+ 5.0: A Review The Know- 
Drive: A Hardware Evaluation i An Improved 
BASIC/Einary Combo | -. 

1 5^ Readers' Softkeys \ Rendezvous With 
Rama | Peaehtree's Back To Basics Accounting 
Sy.stem | HSD Stati.stics Series I A rithme tickle i 
Arithmekitks and Early Games for Children | 
Feature \ Double Your ROM Space | Towards 
a Better F8 ROM | The Nibblcr: A Utility 
Program to Examine Raw Nibbles From Disk | 
Core i The Games of 19S4; In Review- part II | 

1 cS Softkeys \ Scholastic Version of Rank 
Street Writer | Applewnter /'e | SSI's Non-RDOS 
Disks I Readers' Softkeys \ BPI Accounting 
Programs and Design Ware Programs | Features \ 
Installing a Free Sector Patch Into Applewriter 
//e I Simple Copy Protection | Core \ The Games 
of 1984: In Review | 65C02 Chips Now 
Available | Chccksoft v2 | , ,, 

1 7 Softkeyi \ The Print Shop | 
Crossword Magic | The Standing Stones I Beer 

Run I Skyfox | and Random House Disks | 
Features \ A Tutorial For Disk Inspection and the 
Use Of Super 10 B | S-C Macro Assembler 
Directives (reprint) Core \ The Graphic Grabber 
For The Print Shop | The Lone Catalog Arranger 
Part TwoO 

1 ^S Readers' Softkeys \ Rescue Raiders | 
Sheila | Basic Building Blocks | Artsci 
Programs | Crossfire | Softkeys | Sensible Speller 
for ProDOS | Sideways | Feature \ Secret 
Weapon: RAMcaid | Core | The Controller 
Writer | A Fix For The Beyond Castle 
Wolfensteiii Softkey | Tlie Lone Catalog Arranger 
Part 1 

1 ZS Softkeys I Laf Pak i Beyond Castle 
Wolfenstein | Transylvania | The Qnest | 
Elecironic Arts ! Snooper Iroops (Case 2) | DLM 
Software | Learning With Leeper | TellStar 1 
Core 1 C Saver: The Advanced Way to Store 
Super lOR Controllers | Adding New Commands 
to DOS 3,3 I Fi.\lng ProDOS 1 .0. 1 BSAVE Bug | 
Review \ Enhancing Your Apple | Feature \ 
Locksmith 5.0 and Locksniilh Programming 
Language _ 



^ Softkeys \ Zaxxon ! Mask of the Sun | 
Crush I Crumble & Chomp | Snake Byte I DB 
Master | & Mouskattack | Features \ Making 
Liberated Backups That Retain Their Copy 
Protection | S-C Assembler: Review | Disk 
Directory Designer | Core I CDREfiler: Part 1 | 
Upper & Lower Case Output for Zork 

^i Ultima II Character Editor | Softkeys \ 
Ultima II I Witness | Prisoner [1 | Pest Patrol | 
Adventure Tips for Ultima 11 ifc III | Copy II Plus 
PARMS Update '....-. : 

1 Softkeys I Data Reporter ' Multiplan | 
Zork I Features \ PARMS for Copy II Plus | No 
More Bugs | APT's for Clioplifter & Cannonball 
Blitz I 'copycard' Reviews \ Replay | Crackshot | 
Snapshot | Wildcard... 



«9 Gaines: 

Constructmg Your Own Joystick | Compiling 
Games | G>!W£/t£T'/£:»'5: Over 30 of the latest 
and best | Pick Of The Pack: All-time TOP 20 
games | Destructive Forces I EAMON I Graphics 
Magician and GraFORTH | and Dragon Dungeon 



Em. Kb ^ Utilite.';: 
Dynamic Menu | High Res: Scroll Demo I GOTO 
Label: Replace | Line Find j Quick Copy: Copy | 

^^^VSC^C 1 Graphics: 
Memory Map | Test Graphics: Marquee 
Boxes I Jagged Seroher | Low Res: Color 
Character Chart | High Res: Screen Cruncher 
The UFO Factory | Color | Vector 
Graphics :Shimmerlng Shapes | A Shape Table 
Mini-Hditor | Block Graphics; Arcade Quality 
Graphics for BASIC Progranmners | Animation | 



Back issues not listed 
are no longer available. 

But disks are still available for 
AT^f^ Mold- »ut issues ! 

Use the order form 
on the other side of this page 



^¥ri1:er's Guide 



COIMPDTIST 

is a monthly magazine dedicated to the 
serious user of the Apple (or compatible) 
computer. COMPUTIST welcomes anicles 
on a variety of subjects in all levels of 
technical difficulty hut requires accurate 
data, technical competence, correci English 
usage, readable style, and ftilly defined 
jargon and huKzwords. 
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SUBJECTS 



MANUSCRIPT 
MECHANICS 



AH manuscripts must be typed or printed 
on one side of the paper. Text stiould be 
double-spaced. 

Printouts should use a non-compressed 
font with both upper and lower case. A letier 
quality mode is preferred, with each page 
torn at the perforation only. Pages need not 
be stapled logether.The cover page of each 
manuscript should contain the following 
data: 

TITLE OF WORK 

FULL NAME OF AUTHOR 

ADDRESS 

PHONE NUMBER 

Each page of the manuscript anti program 
listing should include the autlior's name, the 
title of the work, and the page ntimber in 
the upper right hand comer. 

The article and any accompanying 
program should he submitted as a 
standoi'd text file on a DOS 3.3 disk. Label 
the disk widi the title of the work and the 
author's full name and address. On disk, text 
must be single-spaced only. Please identi5' 
your editing program. 

Original disks are always r^imed a.s soon 
as possible. Other materials will be returned 
only when adequate rehirn packaging and 
postage is enclosed. We are not responsible 
for unretumed submissions. We will 
gmniiilee the reram of original commercial 
disks mailed to us for verification of an 
accompanying softkey. 

You will be notified of the status of your 
submission within 4 to 6 weeks after it is 
received if the article is a softkey 
accompanied by an original disk. Please 
submit completed manuscripts directly; do 
not query first. Previously published 
material and simultaneous submissions are 
not accepted. 



We prefer material on these topics: 

1) Original program /anicle combinations 

2) General articles (Apple computing) 

3) Softkeys 

4) Advanced Playing Techniques (API's) 

5) Hardware modifications 

6) DOS modifications 

7) Product reviews (hardware and software) 
8> Utilities 

9) Bit Copy Parameters 



WRITING 
YOUR ARTICLE 



ObseiT/e the following points of style: 

A. Always assume that your reader is a 
novice and explain all buzzwords and 
technical jargon. Fay special attention to 
gramniar and punctuation; wc require 
technical competence but also good, 
readable style. 

B. Whenever appropriate, a list of hardware 
and software requirements should be 
included at the beginning of the manuscript. 
When published, this list will he offset from 
the main text. 

C. Include the name and address of die 
manufacturer and die price when a 
commercial program is mentioned. This is 
of particular importance in PRODUCT 
REVIEWS. 

D. When submitting programs, first 
introduce the purpose of the program and 
features of special interest. Include 
background information describing its use- 
Tips for advanced uses, program 
modifications, and utilities can also be 
included. ,'Vvoid long print statements and 
use TABS instead of spaces. 

Remember: A beginner should be able to 
type the program with ease. 

K, A PROGRAM is not accepted for 
publication without an accompanying 
article. These articles, as wei! as anicles on 
hardware and DOS mudiflcalioiis MUST 
summarize the action of the main routines 
and include a fully remarked listing. 



F- GENERAL ARTICLES may include 
advanced tips, tutorials, and explorations of 
a particular aspect of Apple computing. 

G. SOFTKEYS of any length are acceptable 
and must contain detailed step-by-slep 
procedures. For each sofdcey, first introduce 
the locking technique used and then give 
precise steps to unlock ,the copy-protected 
program . Number each step whenever 
possible. We accept articles which explain 
lock-ing technique.s used in several programs 
published by the same company. 

H. When altering game programs, the 
changes made are sometimes extensive 
enough to warrant the title of ADVANCED 
PLAYING TECHNIQUE (APT). APTs can 
deal with alterations to a program, deleting 
annoying sounds, acquiring more points in 
play and avoiding haz.ards. Again, provide 
step-hy-step instructions to complete each 
APT and explain each step's function. 
APT's of 100 words or more are preferred, 



( 



AUTHOR'S RIGHTS 



Each article is published imder the 
autiior's byline. As a rule, all rights, as well 
as one-time reprint rights are purchased. 
Purchase of exclusive rights to programs is 
required; however, alternate arrangements 
may be made with individual authors 
depending on the merit of the contribution. 






PAYMENTS 



COMPUTIST pays upon publication. 
Rate of payment depends on tlie amount of 
editing required and the length of the anicle. 
Payment ranges from $20 to $50 per typeset 
page for an article. We also pay Sit) to $20 
for short softkeys and APT's, A fully 
explained softkey accompanied by the 
commercial disk tor vcnfi cation may earn 
up to $50 per typeset page. 

Please mail your submissiuTisi to: 

COMPUTIST 

Editorial Uepartment 

PO Box 110846-T 

Tacoma, WA 1*8411 




your disks from their uncopyable status 



H Now you can make necessa 
H of your locked-up commercia 
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The 

of Sof tkeys 

shows you 

how to softkey 

(undo copy-protection on) 

commercial software. 

Volumes U and til are being compiled now! 



Volume I 

« ( 1 57 pages) 

* contains softkeys for: 

Akalabeth 

Ampermagic 

Apple Galaxian 

Aztec 

Bag of Tricks 

Bill Budge's Trilogy 

Buzzard Bait 

Cannonball Blitz 

Casino 

Data Reporter 

Deadline 

Disk Organizer II 

Egbert II Communications Disk 

Hard Hat Mack 

Home Accountant 

Homeword 

Lancaster 

Magic Window II 

Multi-disk Catalog 

Multiplan 

4 Pest Patrol 

k" " Prisoner II 

Sammy Lightfoot 

Screen Writer II 

Sneakers 

Spy's Demise 

Starcross 

Suspended 

Ultima II 

_A_ Visifile 

H Visiplot 

Visitrend 

Witness 

Wizardry 

Zork I 

Zork II 

Zork III 

plus how-to articles and program 

listings of need-to- have programs used 

to make unprotected backups. 



I want copies of Ttie Book Of Softl<evs Volurne 1 I fiave enclosed $20 per book. Foreign 

orders add 20%. U.S. funds drawn on U.S. banks. Washington slate orders add 7.8% sales tax. 
Send your orders to; Softkey Publisfiing; PO Box 110816-T; Tacoma, WA 98411 

Name 

Address . , ^^ - ^^ 

City State Zip 

Country Phone 

S 3B - - - Exp. 

Signature ^ ^ - 



